Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2026-32597 (GCVE-0-2026-32597)
Vulnerability from cvelistv5 – Published: 2026-03-12 21:41 – Updated: 2026-08-03 12:05
VLAI
EPSS
VEX
Title
PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)
Summary
PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC. This vulnerability is fixed in 2.12.0.
Severity
7.5 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
35 references
Impacted products
63 products
| Vendor | Product | Version | |
|---|---|---|---|
| jpadilla | pyjwt |
Affected:
< 2.12.0
|
|
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 8 |
Unaffected:
0:4.6.28-3.el8ap , < *
(rpm)
cpe:/a:redhat:ansible_automation_platform:2.5::el8 |
|
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 8 |
Unaffected:
0:2.12.1-1.el8ap , < *
(rpm)
cpe:/a:redhat:ansible_automation_platform:2.5::el8 |
|
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 9 |
Unaffected:
0:4.6.28-3.el9ap , < *
(rpm)
cpe:/a:redhat:ansible_automation_platform:2.5::el9 |
|
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 9 |
Unaffected:
0:2.12.1-1.el9ap , < *
(rpm)
cpe:/a:redhat:ansible_automation_platform:2.5::el9 |
|
| Red Hat | Red Hat Ansible Automation Platform 2.6 for RHEL 9 |
Unaffected:
0:4.7.11-2.el9ap , < *
(rpm)
cpe:/a:redhat:ansible_automation_platform:2.6::el9 |
|
| Red Hat | Red Hat Ansible Automation Platform 2.6 for RHEL 9 |
Unaffected:
0:2.12.1-1.el9ap , < *
(rpm)
cpe:/a:redhat:ansible_automation_platform:2.6::el9 |
|
| Red Hat | Red Hat Enterprise Linux 10 |
Unaffected:
0:4.16.0-13.el10_1.4 , < *
(rpm)
Unaffected: 0:4.16.0-21.el10_2.1 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.1 cpe:/o:redhat:enterprise_linux:10.2 |
|
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support |
Unaffected:
0:4.16.0-5.el10_0.9 , < *
(rpm)
cpe:/o:redhat:enterprise_linux_eus:10.0 |
|
| Red Hat | Red Hat Enterprise Linux 8 |
Unaffected:
0:4.2.1-129.el8_10.25 , < *
(rpm)
cpe:/a:redhat:enterprise_linux:8 |
|
| Red Hat | Red Hat Enterprise Linux 9 |
Unaffected:
0:4.10.0-110.el9_8.2 , < *
(rpm)
Unaffected: 0:4.10.0-98.el9_7.12 , < * (rpm) cpe:/a:redhat:enterprise_linux:9 |
|
| Red Hat | Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions |
Unaffected:
0:4.10.0-43.el9_2.21 , < *
(rpm)
cpe:/a:redhat:rhel_e4s:9.2 |
|
| Red Hat | Red Hat Enterprise Linux 9.4 Extended Update Support |
Unaffected:
0:4.10.0-62.el9_4.24 , < *
(rpm)
cpe:/a:redhat:rhel_eus:9.4 |
|
| Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support |
Unaffected:
0:4.10.0-86.el9_6.16 , < *
(rpm)
cpe:/a:redhat:rhel_eus:9.6 |
|
| Red Hat | Red Hat AI Inference Server 3.3 |
Unaffected:
1775680192 , < *
(rpm)
cpe:/a:redhat:ai_inference_server:3.3::el9 |
|
| Red Hat | Red Hat AI Inference Server 3.3 |
Unaffected:
1775680262 , < *
(rpm)
cpe:/a:redhat:ai_inference_server:3.3::el9 |
|
| Red Hat | Red Hat AI Inference Server 3.3 |
Unaffected:
1775749857 , < *
(rpm)
cpe:/a:redhat:ai_inference_server:3.3::el9 |
|
| Red Hat | Red Hat Ansible Automation Platform 2.5 |
Unaffected:
1777394109 , < *
(rpm)
cpe:/a:redhat:ansible_automation_platform:2.5::el8 |
|
| Red Hat | Red Hat Ansible Automation Platform 2.5 |
Unaffected:
1777403872 , < *
(rpm)
cpe:/a:redhat:ansible_automation_platform:2.5::el8 |
|
| Red Hat | Red Hat Ansible Automation Platform 2.6 |
Unaffected:
1777296732 , < *
(rpm)
cpe:/a:redhat:ansible_automation_platform:2.6::el9 |
|
| Red Hat | Red Hat Ansible Automation Platform 2.6 |
Unaffected:
1777391447 , < *
(rpm)
cpe:/a:redhat:ansible_automation_platform:2.6::el9 |
|
| Red Hat | Red Hat Ansible Automation Platform 2.6 |
Unaffected:
1777311120 , < *
(rpm)
cpe:/a:redhat:ansible_automation_platform:2.6::el9 |
|
| Red Hat | Red Hat Ansible Automation Platform 2.6 |
Unaffected:
1777299023 , < *
(rpm)
cpe:/a:redhat:ansible_automation_platform:2.6::el9 |
|
| Red Hat | Red Hat Ansible Automation Platform 2.6 |
Unaffected:
1777398576 , < *
(rpm)
cpe:/a:redhat:ansible_automation_platform:2.6::el9 |
|
| Red Hat | Red Hat Ansible Automation Platform 2.6 |
Unaffected:
1777387242 , < *
(rpm)
cpe:/a:redhat:ansible_automation_platform:2.6::el9 |
|
| Red Hat | Red Hat Ansible Automation Platform 2.6 |
Unaffected:
1777311601 , < *
(rpm)
cpe:/a:redhat:ansible_automation_platform:2.6::el9 |
|
| Red Hat | Red Hat Enterprise Linux AI 3.3 |
Unaffected:
1776871984 , < *
(rpm)
cpe:/a:redhat:enterprise_linux_ai:3.3::el9 |
|
| Red Hat | Red Hat Enterprise Linux AI 3.3 |
Unaffected:
1776871985 , < *
(rpm)
cpe:/a:redhat:enterprise_linux_ai:3.3::el9 |
|
| Red Hat | Red Hat Enterprise Linux AI 3.3 |
Unaffected:
1776872005 , < *
(rpm)
cpe:/a:redhat:enterprise_linux_ai:3.3::el9 |
|
| Red Hat | Red Hat Enterprise Linux AI 3.3 |
Unaffected:
1776773390 , < *
(rpm)
cpe:/a:redhat:enterprise_linux_ai:3.3::el9 |
|
| Red Hat | Red Hat Enterprise Linux AI 3.3 |
Unaffected:
1776871987 , < *
(rpm)
cpe:/a:redhat:enterprise_linux_ai:3.3::el9 |
|
| Red Hat | Red Hat Enterprise Linux AI 3.3 |
Unaffected:
1776773505 , < *
(rpm)
cpe:/a:redhat:enterprise_linux_ai:3.3::el9 |
|
| Red Hat | Red Hat Enterprise Linux AI 3.3 |
Unaffected:
1776938871 , < *
(rpm)
cpe:/a:redhat:enterprise_linux_ai:3.3::el9 |
|
| Red Hat | Red Hat OpenShift AI 2.25 |
Unaffected:
1776338381 , < *
(rpm)
cpe:/a:redhat:openshift_ai:2.25::el9 |
|
| Red Hat | Red Hat OpenShift AI 2.25 |
Unaffected:
1776343111 , < *
(rpm)
cpe:/a:redhat:openshift_ai:2.25::el9 |
|
| Red Hat | Red Hat OpenShift AI 2.25 |
Unaffected:
1780069069 , < *
(rpm)
cpe:/a:redhat:openshift_ai:2.25::el9 |
|
| Red Hat | Red Hat OpenShift AI 2.25 |
Unaffected:
1783696512 , < *
(rpm)
cpe:/a:redhat:openshift_ai:2.25::el9 |
|
| Red Hat | Red Hat OpenShift AI 2.25 |
Unaffected:
1783616068 , < *
(rpm)
cpe:/a:redhat:openshift_ai:2.25::el9 |
|
| Red Hat | Red Hat OpenShift AI 2.25 |
Unaffected:
1783998551 , < *
(rpm)
cpe:/a:redhat:openshift_ai:2.25::el9 |
|
| Red Hat | Red Hat OpenShift AI 2.25 |
Unaffected:
1783664916 , < *
(rpm)
cpe:/a:redhat:openshift_ai:2.25::el9 |
|
| Red Hat | Red Hat OpenShift AI 2.25 |
Unaffected:
1783615385 , < *
(rpm)
cpe:/a:redhat:openshift_ai:2.25::el9 |
|
| Red Hat | Red Hat OpenShift AI 2.25 |
Unaffected:
1783664921 , < *
(rpm)
cpe:/a:redhat:openshift_ai:2.25::el9 |
|
| Red Hat | Red Hat OpenShift AI 2.25 |
Unaffected:
1783696507 , < *
(rpm)
cpe:/a:redhat:openshift_ai:2.25::el9 |
|
| Red Hat | Red Hat OpenShift AI 2.25 |
Unaffected:
1783615414 , < *
(rpm)
cpe:/a:redhat:openshift_ai:2.25::el9 |
|
| Red Hat | Red Hat OpenShift AI 2.25 |
Unaffected:
1783998585 , < *
(rpm)
cpe:/a:redhat:openshift_ai:2.25::el9 |
|
| Red Hat | Red Hat OpenShift AI 2.25 |
Unaffected:
1783615165 , < *
(rpm)
cpe:/a:redhat:openshift_ai:2.25::el9 |
|
| Red Hat | Red Hat OpenShift AI 2.25 |
Unaffected:
1783615432 , < *
(rpm)
cpe:/a:redhat:openshift_ai:2.25::el9 |
|
| Red Hat | Red Hat OpenShift AI 3.3 |
Unaffected:
1778264363 , < *
(rpm)
cpe:/a:redhat:openshift_ai:3.3::el9 |
|
| Red Hat | Red Hat OpenShift AI 3.3 |
Unaffected:
1778600187 , < *
(rpm)
cpe:/a:redhat:openshift_ai:3.3::el9 |
|
| Red Hat | Red Hat OpenShift AI 3.3 |
Unaffected:
1782472374 , < *
(rpm)
cpe:/a:redhat:openshift_ai:3.3::el9 |
|
| Red Hat | Red Hat Quay 3.1 |
Unaffected:
1775169155 , < *
(rpm)
cpe:/a:redhat:quay:3.10::el8 |
|
| Red Hat | Red Hat Quay 3.12 |
Unaffected:
1775253092 , < *
(rpm)
cpe:/a:redhat:quay:3.12::el8 |
|
| Red Hat | Red Hat Quay 3.15 |
Unaffected:
1775169219 , < *
(rpm)
cpe:/a:redhat:quay:3.15::el8 |
|
| Red Hat | Red Hat Quay 3.16 |
Unaffected:
1779204086 , < *
(rpm)
cpe:/a:redhat:quay:3.16::el9 |
|
| Red Hat | Red Hat Quay 3.9 |
Unaffected:
1775169218 , < *
(rpm)
cpe:/a:redhat:quay:3.9::el8 |
|
| Red Hat | Red Hat Satellite 6.18 |
Unaffected:
1780414237 , < *
(rpm)
cpe:/a:redhat:satellite:6.18::el9 |
|
| Red Hat | Red Hat Trusted Artifact Signer 1.4 |
Unaffected:
1775815407 , < *
(rpm)
cpe:/a:redhat:trusted_artifact_signer:1.4::el9 |
|
| Red Hat | OpenShift Lightspeed |
cpe:/a:redhat:openshift_lightspeed |
|
| Red Hat | Red Hat AI Inference Server |
cpe:/a:redhat:ai_inference_server:3 |
|
| Red Hat | Red Hat Ansible Automation Platform 2 |
cpe:/a:redhat:ansible_automation_platform:2 |
|
| Red Hat | Red Hat OpenShift AI (RHOAI) |
cpe:/a:redhat:openshift_ai |
|
| Red Hat | Red Hat Satellite 6 |
cpe:/a:redhat:satellite:6 |
|
| Red Hat | Red Hat Trusted Artifact Signer |
cpe:/a:redhat:trusted_artifact_signer:1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-32597",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-13T14:48:42.534762Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-13T14:58:58.769Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-752w-5fwx-jx9f"
}
],
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2026-05-05T17:32:42.698Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://lists.debian.org/debian-lts-announce/2026/05/msg00008.html"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.5::el8"
],
"defaultStatus": "affected",
"packageName": "automation-controller",
"product": "Red Hat Ansible Automation Platform 2.5 for RHEL 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.6.28-3.el8ap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.5::el8"
],
"defaultStatus": "affected",
"packageName": "python3.12-pyjwt",
"product": "Red Hat Ansible Automation Platform 2.5 for RHEL 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.12.1-1.el8ap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.5::el9"
],
"defaultStatus": "affected",
"packageName": "automation-controller",
"product": "Red Hat Ansible Automation Platform 2.5 for RHEL 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.6.28-3.el9ap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.5::el9"
],
"defaultStatus": "affected",
"packageName": "python3.12-pyjwt",
"product": "Red Hat Ansible Automation Platform 2.5 for RHEL 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.12.1-1.el9ap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.6::el9"
],
"defaultStatus": "affected",
"packageName": "automation-controller",
"product": "Red Hat Ansible Automation Platform 2.6 for RHEL 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.7.11-2.el9ap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.6::el9"
],
"defaultStatus": "affected",
"packageName": "python3.12-pyjwt",
"product": "Red Hat Ansible Automation Platform 2.6 for RHEL 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.12.1-1.el9ap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.1",
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "affected",
"packageName": "fence-agents",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.16.0-13.el10_1.4",
"versionType": "rpm"
},
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.16.0-21.el10_2.1",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux_eus:10.0"
],
"defaultStatus": "affected",
"packageName": "fence-agents",
"product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.16.0-5.el10_0.9",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "fence-agents",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.2.1-129.el8_10.25",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "fence-agents",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.10.0-110.el9_8.2",
"versionType": "rpm"
},
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.10.0-98.el9_7.12",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.2"
],
"defaultStatus": "affected",
"packageName": "fence-agents",
"product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.10.0-43.el9_2.21",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_eus:9.4"
],
"defaultStatus": "affected",
"packageName": "fence-agents",
"product": "Red Hat Enterprise Linux 9.4 Extended Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.10.0-62.el9_4.24",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_eus:9.6"
],
"defaultStatus": "affected",
"packageName": "fence-agents",
"product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.10.0-86.el9_6.16",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3.3::el9"
],
"defaultStatus": "affected",
"packageName": "rhaiis/vllm-cuda-rhel9",
"product": "Red Hat AI Inference Server 3.3",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1775680192",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3.3::el9"
],
"defaultStatus": "affected",
"packageName": "rhaiis/vllm-rocm-rhel9",
"product": "Red Hat AI Inference Server 3.3",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1775680262",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3.3::el9"
],
"defaultStatus": "affected",
"packageName": "rhaiis/model-opt-cuda-rhel9",
"product": "Red Hat AI Inference Server 3.3",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1775749857",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.5::el8"
],
"defaultStatus": "affected",
"packageName": "ansible-automation-platform-25/gateway-rhel8",
"product": "Red Hat Ansible Automation Platform 2.5",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1777394109",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.5::el8"
],
"defaultStatus": "affected",
"packageName": "ansible-automation-platform-25/lightspeed-rhel8",
"product": "Red Hat Ansible Automation Platform 2.5",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1777403872",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.6::el9"
],
"defaultStatus": "affected",
"packageName": "ansible-automation-platform-26/eda-controller-rhel9",
"product": "Red Hat Ansible Automation Platform 2.6",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1777296732",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.6::el9"
],
"defaultStatus": "affected",
"packageName": "ansible-automation-platform-26/ee-supported-rhel9",
"product": "Red Hat Ansible Automation Platform 2.6",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1777391447",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.6::el9"
],
"defaultStatus": "affected",
"packageName": "ansible-automation-platform-26/gateway-rhel9",
"product": "Red Hat Ansible Automation Platform 2.6",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1777311120",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.6::el9"
],
"defaultStatus": "affected",
"packageName": "ansible-automation-platform-26/hub-rhel9",
"product": "Red Hat Ansible Automation Platform 2.6",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1777299023",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.6::el9"
],
"defaultStatus": "affected",
"packageName": "ansible-automation-platform-26/lightspeed-chatbot-rhel9",
"product": "Red Hat Ansible Automation Platform 2.6",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1777398576",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.6::el9"
],
"defaultStatus": "affected",
"packageName": "ansible-automation-platform-26/lightspeed-rhel9",
"product": "Red Hat Ansible Automation Platform 2.6",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1777387242",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.6::el9"
],
"defaultStatus": "affected",
"packageName": "ansible-automation-platform-26/mcp-tools-rhel9",
"product": "Red Hat Ansible Automation Platform 2.6",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1777311601",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3.3::el9"
],
"defaultStatus": "affected",
"packageName": "rhelai3/bootc-aws-cuda-rhel9",
"product": "Red Hat Enterprise Linux AI 3.3",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1776871984",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3.3::el9"
],
"defaultStatus": "affected",
"packageName": "rhelai3/bootc-azure-cuda-rhel9",
"product": "Red Hat Enterprise Linux AI 3.3",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1776871985",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3.3::el9"
],
"defaultStatus": "affected",
"packageName": "rhelai3/bootc-azure-rocm-rhel9",
"product": "Red Hat Enterprise Linux AI 3.3",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1776872005",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3.3::el9"
],
"defaultStatus": "affected",
"packageName": "rhelai3/bootc-cuda-rhel9",
"product": "Red Hat Enterprise Linux AI 3.3",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1776773390",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3.3::el9"
],
"defaultStatus": "affected",
"packageName": "rhelai3/bootc-gcp-cuda-rhel9",
"product": "Red Hat Enterprise Linux AI 3.3",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1776871987",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3.3::el9"
],
"defaultStatus": "affected",
"packageName": "rhelai3/bootc-rocm-rhel9",
"product": "Red Hat Enterprise Linux AI 3.3",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1776773505",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3.3::el9"
],
"defaultStatus": "affected",
"packageName": "rhelai3/disk-image-cuda-rhel9",
"product": "Red Hat Enterprise Linux AI 3.3",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1776938871",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_ai:2.25::el9"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-feature-server-rhel9",
"product": "Red Hat OpenShift AI 2.25",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1776338381",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_ai:2.25::el9"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-kserve-storage-initializer-rhel9",
"product": "Red Hat OpenShift AI 2.25",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1776343111",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_ai:2.25::el9"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-vllm-gaudi-rhel9",
"product": "Red Hat OpenShift AI 2.25",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1780069069",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_ai:2.25::el9"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9",
"product": "Red Hat OpenShift AI 2.25",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1783696512",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_ai:2.25::el9"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9",
"product": "Red Hat OpenShift AI 2.25",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1783616068",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_ai:2.25::el9"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9",
"product": "Red Hat OpenShift AI 2.25",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1783998551",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_ai:2.25::el9"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9",
"product": "Red Hat OpenShift AI 2.25",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1783664916",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_ai:2.25::el9"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9",
"product": "Red Hat OpenShift AI 2.25",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1783615385",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_ai:2.25::el9"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9",
"product": "Red Hat OpenShift AI 2.25",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1783664921",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_ai:2.25::el9"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9",
"product": "Red Hat OpenShift AI 2.25",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1783696507",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_ai:2.25::el9"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9",
"product": "Red Hat OpenShift AI 2.25",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1783615414",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_ai:2.25::el9"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9",
"product": "Red Hat OpenShift AI 2.25",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1783998585",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_ai:2.25::el9"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9",
"product": "Red Hat OpenShift AI 2.25",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1783664921",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_ai:2.25::el9"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9",
"product": "Red Hat OpenShift AI 2.25",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1783615165",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_ai:2.25::el9"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9",
"product": "Red Hat OpenShift AI 2.25",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1783664921",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_ai:2.25::el9"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9",
"product": "Red Hat OpenShift AI 2.25",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1783615432",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_ai:3.3::el9"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-vllm-cpu-rhel9",
"product": "Red Hat OpenShift AI 3.3",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1778264363",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_ai:3.3::el9"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-vllm-gaudi-rhel9",
"product": "Red Hat OpenShift AI 3.3",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1778600187",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_ai:3.3::el9"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-trustyai-garak-lls-provider-dsp-rhel9",
"product": "Red Hat OpenShift AI 3.3",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782472374",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:quay:3.10::el8"
],
"defaultStatus": "affected",
"packageName": "quay/quay-rhel8",
"product": "Red Hat Quay 3.1",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1775169155",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:quay:3.12::el8"
],
"defaultStatus": "affected",
"packageName": "quay/quay-rhel8",
"product": "Red Hat Quay 3.12",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1775253092",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:quay:3.15::el8"
],
"defaultStatus": "affected",
"packageName": "quay/quay-rhel8",
"product": "Red Hat Quay 3.15",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1775169219",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:quay:3.16::el9"
],
"defaultStatus": "affected",
"packageName": "quay/quay-rhel9",
"product": "Red Hat Quay 3.16",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1779204086",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:quay:3.9::el8"
],
"defaultStatus": "affected",
"packageName": "quay/quay-rhel8",
"product": "Red Hat Quay 3.9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1775169218",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:satellite:6.18::el9"
],
"defaultStatus": "affected",
"packageName": "satellite/iop-host-inventory-rhel9",
"product": "Red Hat Satellite 6.18",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1780414237",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:trusted_artifact_signer:1.4::el9"
],
"defaultStatus": "affected",
"packageName": "rhtas/model-transparency-rhel9",
"product": "Red Hat Trusted Artifact Signer 1.4",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1775815407",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_lightspeed"
],
"defaultStatus": "affected",
"packageName": "openshift-lightspeed/lightspeed-ocp-rag-rhel9",
"product": "OpenShift Lightspeed",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_lightspeed"
],
"defaultStatus": "affected",
"packageName": "openshift-lightspeed/lightspeed-service-api-rhel9",
"product": "OpenShift Lightspeed",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_lightspeed"
],
"defaultStatus": "affected",
"packageName": "openshift-lightspeed/lightspeed-to-dataverse-exporter-rhel9",
"product": "OpenShift Lightspeed",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
],
"defaultStatus": "affected",
"packageName": "rhaiis/vllm-cpu-rhel9",
"product": "Red Hat AI Inference Server",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
],
"defaultStatus": "affected",
"packageName": "rhaiis/vllm-tpu-rhel9",
"product": "Red Hat AI Inference Server",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
],
"defaultStatus": "unaffected",
"packageName": "ansible-automation-platform-24/ee-supported-rhel8",
"product": "Red Hat Ansible Automation Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
],
"defaultStatus": "unaffected",
"packageName": "ansible-automation-platform-24/platform-resource-runner-rhel8",
"product": "Red Hat Ansible Automation Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
],
"defaultStatus": "unaffected",
"packageName": "ansible-automation-platform-25/ee-supported-rhel8",
"product": "Red Hat Ansible Automation Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
],
"defaultStatus": "affected",
"packageName": "ansible-automation-platform-25/lightspeed-chatbot-rhel8",
"product": "Red Hat Ansible Automation Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
],
"defaultStatus": "affected",
"packageName": "ansible-automation-platform-26/controller-rhel9",
"product": "Red Hat Ansible Automation Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
],
"defaultStatus": "affected",
"packageName": "ansible-automation-platform/automation-dashboard-rhel9",
"product": "Red Hat Ansible Automation Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
],
"defaultStatus": "unaffected",
"packageName": "ansible-automation-platform-tech-preview/automation-dashboard-rhel9",
"product": "Red Hat Ansible Automation Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-kserve-agent-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-kserve-controller-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-kserve-router-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-llama-stack-core-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-mlflow-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-workbench-jupyter-minimal-rocm-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:satellite:6"
],
"defaultStatus": "affected",
"packageName": "satellite/foreman-mcp-server-rhel9",
"product": "Red Hat Satellite 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:trusted_artifact_signer:1"
],
"defaultStatus": "affected",
"packageName": "rhtas/segment-reporting-rhel9",
"product": "Red Hat Trusted Artifact Signer",
"vendor": "Red Hat"
}
],
"datePublic": "2026-03-12T21:41:50.427Z",
"descriptions": [
{
"lang": "en",
"value": "A missing verification step has been discovered in PyJWT. PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 \u00a74.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-347",
"description": "Improper Verification of Cryptographic Signature",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-03T12:05:42.693Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-32597"
},
{
"name": "RHBZ#2447194",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447194"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32597.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:13512"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:13508"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:17083"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:13916"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:19138"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:12176"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:22330"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:21517"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:21431"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:13672"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:19355"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:8748"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:8746"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:8747"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:13553"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:13545"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:10140"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:10141"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:10184"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:42644"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:24977"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:37275"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:19712"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:6720"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:6568"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:19375"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:6912"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:6926"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:26226"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:8437"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:13512: Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9"
},
{
"lang": "en",
"value": "RHSA-2026:13508: Red Hat Ansible Automation Platform 2.6 for RHEL 9"
},
{
"lang": "en",
"value": "RHSA-2026:17083: Red Hat Enterprise Linux AppStream EUS (v. 10.0)"
},
{
"lang": "en",
"value": "RHSA-2026:13916: Red Hat Enterprise Linux AppStream (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:19138: Red Hat Enterprise Linux AppStream (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:12176: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux HighAvailability (v. 8), Red Hat Enterprise Linux ResilientStorage (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:22330: Red Hat Enterprise Linux AppStream E4S (v.9.2), Red Hat Enterprise Linux High Availability E4S (v.9.2), Red Hat Enterprise Linux Resilient Storage E4S (v.9.2)"
},
{
"lang": "en",
"value": "RHSA-2026:21517: Red Hat Enterprise Linux AppStream EUS (v.9.4), Red Hat Enterprise Linux High Availability EUS (v.9.4), Red Hat Enterprise Linux Resilient Storage EUS (v.9.4)"
},
{
"lang": "en",
"value": "RHSA-2026:21431: Red Hat Enterprise Linux AppStream EUS (v.9.6)"
},
{
"lang": "en",
"value": "RHSA-2026:13672: Red Hat Enterprise Linux AppStream (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:19355: Red Hat Enterprise Linux AppStream (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:8748: Red Hat AI Inference Server 3.3"
},
{
"lang": "en",
"value": "RHSA-2026:8746: Red Hat AI Inference Server 3.3"
},
{
"lang": "en",
"value": "RHSA-2026:8747: Red Hat AI Inference Server 3.3"
},
{
"lang": "en",
"value": "RHSA-2026:13553: Red Hat Ansible Automation Platform 2.5"
},
{
"lang": "en",
"value": "RHSA-2026:13545: Red Hat Ansible Automation Platform 2.6"
},
{
"lang": "en",
"value": "RHSA-2026:10140: Red Hat Enterprise Linux AI 3.3"
},
{
"lang": "en",
"value": "RHSA-2026:10141: Red Hat Enterprise Linux AI 3.3"
},
{
"lang": "en",
"value": "RHSA-2026:10184: Red Hat OpenShift AI 2.25"
},
{
"lang": "en",
"value": "RHSA-2026:42644: Red Hat OpenShift AI 2.25"
},
{
"lang": "en",
"value": "RHSA-2026:24977: Red Hat OpenShift AI 2.25"
},
{
"lang": "en",
"value": "RHSA-2026:37275: Red Hat OpenShift AI 3.3"
},
{
"lang": "en",
"value": "RHSA-2026:19712: Red Hat OpenShift AI 3.3"
},
{
"lang": "en",
"value": "RHSA-2026:6720: Red Hat Quay 3.12"
},
{
"lang": "en",
"value": "RHSA-2026:6568: Red Hat Quay 3.15"
},
{
"lang": "en",
"value": "RHSA-2026:19375: Red Hat Quay 3.16"
},
{
"lang": "en",
"value": "RHSA-2026:6912: Red Hat Quay 3.1"
},
{
"lang": "en",
"value": "RHSA-2026:6926: Red Hat Quay 3.9"
},
{
"lang": "en",
"value": "RHSA-2026:26226: Red Hat Satellite 6.18"
},
{
"lang": "en",
"value": "RHSA-2026:8437: Red Hat Trusted Artifact Signer 1.4"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-03-12T22:01:29.967Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-03-12T21:41:50.427Z",
"value": "Made public."
}
],
"title": "pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 \u00a74.1.11 MUST violation)",
"workarounds": [
{
"lang": "en",
"value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."
}
],
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"product": "pyjwt",
"vendor": "jpadilla",
"versions": [
{
"status": "affected",
"version": "\u003c 2.12.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 \u00a74.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC. This vulnerability is fixed in 2.12.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-345",
"description": "CWE-345: Insufficient Verification of Data Authenticity",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-12T21:41:50.427Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-752w-5fwx-jx9f",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-752w-5fwx-jx9f"
}
],
"source": {
"advisory": "GHSA-752w-5fwx-jx9f",
"discovery": "UNKNOWN"
},
"title": "PyJWT accepts unknown `crit` header extensions (RFC 7515 \u00a74.1.11 MUST violation)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-32597",
"datePublished": "2026-03-12T21:41:50.427Z",
"dateReserved": "2026-03-12T14:54:24.269Z",
"dateUpdated": "2026-08-03T12:05:42.693Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-32597",
"date": "2026-08-10",
"epss": "0.00269",
"percentile": "0.1877"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2026-32597\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-03-13T19:55:09.500\",\"lastModified\":\"2026-07-22T12:17:34.467\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 \u00a74.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC. This vulnerability is fixed in 2.12.0.\"},{\"lang\":\"es\",\"value\":\"PyJWT es una implementaci\u00f3n de JSON Web Token en Python. Antes de la 2.12.0, PyJWT no valida el par\u00e1metro de encabezado crit (Cr\u00edtico) definido en la RFC 7515 \u00a74.1.11. Cuando un token JWS contiene un array crit que lista extensiones que PyJWT no entiende, la biblioteca acepta el token en lugar de rechazarlo. Esto viola el requisito MUST en la RFC. Esta vulnerabilidad est\u00e1 corregida en la 2.12.0.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"jpadilla\",\"product\":\"pyjwt\",\"versions\":[{\"version\":\"\u003c 2.12.0\",\"status\":\"affected\"}]}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"affectedData\":[{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2.5 for RHEL 8\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"automation-controller\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2.5::el8\"],\"versions\":[{\"version\":\"0:4.6.28-3.el8ap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2.5 for RHEL 8\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"python3.12-pyjwt\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2.5::el8\"],\"versions\":[{\"version\":\"0:2.12.1-1.el8ap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2.5 for RHEL 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"automation-controller\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2.5::el9\"],\"versions\":[{\"version\":\"0:4.6.28-3.el9ap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2.5 for RHEL 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"python3.12-pyjwt\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2.5::el9\"],\"versions\":[{\"version\":\"0:2.12.1-1.el9ap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2.6 for RHEL 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"automation-controller\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2.6::el9\"],\"versions\":[{\"version\":\"0:4.7.11-2.el9ap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2.6 for RHEL 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"python3.12-pyjwt\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2.6::el9\"],\"versions\":[{\"version\":\"0:2.12.1-1.el9ap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"fence-agents\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10.1\",\"cpe:/o:redhat:enterprise_linux:10.2\"],\"versions\":[{\"version\":\"0:4.16.0-13.el10_1.4\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"},{\"version\":\"0:4.16.0-21.el10_2.1\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10.0 Extended Update Support\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"fence-agents\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux_eus:10.0\"],\"versions\":[{\"version\":\"0:4.16.0-5.el10_0.9\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"fence-agents\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux:8\"],\"versions\":[{\"version\":\"0:4.2.1-129.el8_10.25\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"fence-agents\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux:9\"],\"versions\":[{\"version\":\"0:4.10.0-110.el9_8.2\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"},{\"version\":\"0:4.10.0-98.el9_7.12\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"fence-agents\",\"cpes\":[\"cpe:/a:redhat:rhel_e4s:9.2\"],\"versions\":[{\"version\":\"0:4.10.0-43.el9_2.21\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9.4 Extended Update Support\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"fence-agents\",\"cpes\":[\"cpe:/a:redhat:rhel_eus:9.4\"],\"versions\":[{\"version\":\"0:4.10.0-62.el9_4.24\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9.6 Extended Update Support\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"fence-agents\",\"cpes\":[\"cpe:/a:redhat:rhel_eus:9.6\"],\"versions\":[{\"version\":\"0:4.10.0-86.el9_6.16\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat AI Inference Server 3.3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhaiis/vllm-cuda-rhel9\",\"cpes\":[\"cpe:/a:redhat:ai_inference_server:3.3::el9\"],\"versions\":[{\"version\":\"1775680192\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat AI Inference Server 3.3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhaiis/vllm-rocm-rhel9\",\"cpes\":[\"cpe:/a:redhat:ai_inference_server:3.3::el9\"],\"versions\":[{\"version\":\"1775680262\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat AI Inference Server 3.3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhaiis/model-opt-cuda-rhel9\",\"cpes\":[\"cpe:/a:redhat:ai_inference_server:3.3::el9\"],\"versions\":[{\"version\":\"1775749857\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2.5\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ansible-automation-platform-25/gateway-rhel8\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2.5::el8\"],\"versions\":[{\"version\":\"1777394109\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2.5\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ansible-automation-platform-25/lightspeed-rhel8\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2.5::el8\"],\"versions\":[{\"version\":\"1777403872\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2.6\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ansible-automation-platform-26/eda-controller-rhel9\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2.6::el9\"],\"versions\":[{\"version\":\"1777296732\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2.6\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ansible-automation-platform-26/ee-supported-rhel9\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2.6::el9\"],\"versions\":[{\"version\":\"1777391447\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2.6\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ansible-automation-platform-26/gateway-rhel9\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2.6::el9\"],\"versions\":[{\"version\":\"1777311120\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2.6\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ansible-automation-platform-26/hub-rhel9\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2.6::el9\"],\"versions\":[{\"version\":\"1777299023\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2.6\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ansible-automation-platform-26/lightspeed-chatbot-rhel9\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2.6::el9\"],\"versions\":[{\"version\":\"1777398576\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2.6\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ansible-automation-platform-26/lightspeed-rhel9\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2.6::el9\"],\"versions\":[{\"version\":\"1777387242\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2.6\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ansible-automation-platform-26/mcp-tools-rhel9\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2.6::el9\"],\"versions\":[{\"version\":\"1777311601\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AI 3.3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhelai3/bootc-aws-cuda-rhel9\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux_ai:3.3::el9\"],\"versions\":[{\"version\":\"1776871984\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AI 3.3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhelai3/bootc-azure-cuda-rhel9\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux_ai:3.3::el9\"],\"versions\":[{\"version\":\"1776871985\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AI 3.3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhelai3/bootc-azure-rocm-rhel9\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux_ai:3.3::el9\"],\"versions\":[{\"version\":\"1776872005\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AI 3.3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhelai3/bootc-cuda-rhel9\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux_ai:3.3::el9\"],\"versions\":[{\"version\":\"1776773390\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AI 3.3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhelai3/bootc-gcp-cuda-rhel9\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux_ai:3.3::el9\"],\"versions\":[{\"version\":\"1776871987\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AI 3.3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhelai3/bootc-rocm-rhel9\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux_ai:3.3::el9\"],\"versions\":[{\"version\":\"1776773505\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AI 3.3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhelai3/disk-image-cuda-rhel9\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux_ai:3.3::el9\"],\"versions\":[{\"version\":\"1776938871\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI 2.25\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhoai/odh-feature-server-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai:2.25::el9\"],\"versions\":[{\"version\":\"1776338381\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI 2.25\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhoai/odh-kserve-storage-initializer-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai:2.25::el9\"],\"versions\":[{\"version\":\"1776343111\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI 2.25\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhoai/odh-vllm-gaudi-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai:2.25::el9\"],\"versions\":[{\"version\":\"1780069069\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI 2.25\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai:2.25::el9\"],\"versions\":[{\"version\":\"1783696512\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI 2.25\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai:2.25::el9\"],\"versions\":[{\"version\":\"1783616068\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI 2.25\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai:2.25::el9\"],\"versions\":[{\"version\":\"1783998551\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI 2.25\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai:2.25::el9\"],\"versions\":[{\"version\":\"1783664916\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI 2.25\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai:2.25::el9\"],\"versions\":[{\"version\":\"1783615385\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI 2.25\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai:2.25::el9\"],\"versions\":[{\"version\":\"1783664921\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI 2.25\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai:2.25::el9\"],\"versions\":[{\"version\":\"1783696507\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI 2.25\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai:2.25::el9\"],\"versions\":[{\"version\":\"1783615414\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI 2.25\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai:2.25::el9\"],\"versions\":[{\"version\":\"1783998585\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI 2.25\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai:2.25::el9\"],\"versions\":[{\"version\":\"1783664921\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI 2.25\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai:2.25::el9\"],\"versions\":[{\"version\":\"1783615165\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI 2.25\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai:2.25::el9\"],\"versions\":[{\"version\":\"1783664921\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI 2.25\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai:2.25::el9\"],\"versions\":[{\"version\":\"1783615432\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI 3.3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhoai/odh-vllm-cpu-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai:3.3::el9\"],\"versions\":[{\"version\":\"1778264363\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI 3.3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhoai/odh-vllm-gaudi-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai:3.3::el9\"],\"versions\":[{\"version\":\"1778600187\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI 3.3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhoai/odh-trustyai-garak-lls-provider-dsp-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai:3.3::el9\"],\"versions\":[{\"version\":\"1782472374\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Quay 3.1\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"quay/quay-rhel8\",\"cpes\":[\"cpe:/a:redhat:quay:3.10::el8\"],\"versions\":[{\"version\":\"1775169155\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Quay 3.12\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"quay/quay-rhel8\",\"cpes\":[\"cpe:/a:redhat:quay:3.12::el8\"],\"versions\":[{\"version\":\"1775253092\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Quay 3.15\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"quay/quay-rhel8\",\"cpes\":[\"cpe:/a:redhat:quay:3.15::el8\"],\"versions\":[{\"version\":\"1775169219\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Quay 3.16\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"quay/quay-rhel9\",\"cpes\":[\"cpe:/a:redhat:quay:3.16::el9\"],\"versions\":[{\"version\":\"1779204086\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Quay 3.9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"quay/quay-rhel8\",\"cpes\":[\"cpe:/a:redhat:quay:3.9::el8\"],\"versions\":[{\"version\":\"1775169218\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Satellite 6.18\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"satellite/iop-host-inventory-rhel9\",\"cpes\":[\"cpe:/a:redhat:satellite:6.18::el9\"],\"versions\":[{\"version\":\"1780414237\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Trusted Artifact Signer 1.4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhtas/model-transparency-rhel9\",\"cpes\":[\"cpe:/a:redhat:trusted_artifact_signer:1.4::el9\"],\"versions\":[{\"version\":\"1775815407\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Lightspeed\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift-lightspeed/lightspeed-ocp-rag-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_lightspeed\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Lightspeed\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift-lightspeed/lightspeed-service-api-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_lightspeed\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Lightspeed\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift-lightspeed/lightspeed-to-dataverse-exporter-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_lightspeed\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat AI Inference Server\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhaiis/vllm-cpu-rhel9\",\"cpes\":[\"cpe:/a:redhat:ai_inference_server:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat AI Inference Server\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhaiis/vllm-tpu-rhel9\",\"cpes\":[\"cpe:/a:redhat:ai_inference_server:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"ansible-automation-platform-24/ee-supported-rhel8\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"ansible-automation-platform-24/platform-resource-runner-rhel8\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"ansible-automation-platform-25/ee-supported-rhel8\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"ansible-automation-platform-25/lightspeed-chatbot-rhel8\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"ansible-automation-platform-26/controller-rhel9\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"ansible-automation-platform/automation-dashboard-rhel9\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"ansible-automation-platform-tech-preview/automation-dashboard-rhel9\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-kserve-agent-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-kserve-controller-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-kserve-router-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-llama-stack-core-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-mlflow-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-workbench-jupyter-minimal-rocm-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Satellite 6\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"satellite/foreman-mcp-server-rhel9\",\"cpes\":[\"cpe:/a:redhat:satellite:6\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Trusted Artifact Signer\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhtas/segment-reporting-rhel9\",\"cpes\":[\"cpe:/a:redhat:trusted_artifact_signer:1\"]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-03-13T14:48:42.534762Z\",\"id\":\"CVE-2026-32597\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-345\"},{\"lang\":\"en\",\"value\":\"CWE-863\"}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-347\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:pyjwt_project:pyjwt:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2.12.0\",\"matchCriteriaId\":\"D2DD4AAA-0853-4F5A-A6BA-DB29F584BD6E\"}]}]}],\"references\":[{\"url\":\"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-752w-5fwx-jx9f\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Exploit\",\"Mitigation\",\"Vendor Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2026/05/msg00008.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:10140\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:10141\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:10184\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:12176\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:13508\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:13512\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:13545\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:13553\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:13672\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:13916\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:17083\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:19138\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:19355\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:19375\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:19712\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:21431\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:21517\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:22330\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:24977\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:26226\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:37275\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:42644\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:6568\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:6720\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:6912\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:6926\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:8437\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:8746\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:8747\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:8748\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/security/cve/CVE-2026-32597\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=2447194\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-752w-5fwx-jx9f\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"tags\":[\"Exploit\",\"Mitigation\",\"Vendor Advisory\"]},{\"url\":\"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32597.json\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"}]}}",
"redhat_vex": {
"aggregate_severity": "Important",
"current_release_date": "2026-08-01T23:40:03+00:00",
"cve": "CVE-2026-32597",
"id": "CVE-2026-32597",
"initial_release_date": "2026-03-12T21:41:50.427000+00:00",
"product_status:fixed": "1198",
"product_status:known_affected": "12",
"product_status:known_not_affected": "2142",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 \u00a74.1.11 MUST violation)",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32597.json",
"version": "3"
},
"suse_vex": {
"aggregate_severity": "important",
"current_release_date": "2026-05-07T02:21:10Z",
"cve": "CVE-2026-32597",
"id": "CVE-2026-32597",
"initial_release_date": "2026-05-07T02:21:10Z",
"product_status:first_fixed": "1",
"product_status:known_affected": "360",
"product_status:recommended": "174",
"source": "SUSE CSAF VEX",
"status": "interim",
"title": "SUSE CVE CVE-2026-32597",
"url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-32597.json",
"version": "2"
},
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2026/05/msg00008.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2026-05-05T17:32:42.698Z\"}}, {\"title\": \"pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 \\u00a74.1.11 MUST violation)\", \"metrics\": [{\"other\": {\"type\": \"Red Hat severity rating\", \"content\": {\"value\": \"Important\", \"namespace\": \"https://access.redhat.com/security/updates/classification/\"}}}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2.5::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2.5 for RHEL 8\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:4.6.28-3.el8ap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"automation-controller\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2.5::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2.5 for RHEL 8\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:2.12.1-1.el8ap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"python3.12-pyjwt\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2.5::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2.5 for RHEL 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:4.6.28-3.el9ap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"automation-controller\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2.5::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2.5 for RHEL 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:2.12.1-1.el9ap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"python3.12-pyjwt\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2.6::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2.6 for RHEL 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:4.7.11-2.el9ap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"automation-controller\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2.6::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2.6 for RHEL 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:2.12.1-1.el9ap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"python3.12-pyjwt\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10.1\", \"cpe:/o:redhat:enterprise_linux:10.2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:4.16.0-13.el10_1.4\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}, {\"status\": \"unaffected\", \"version\": \"0:4.16.0-21.el10_2.1\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"fence-agents\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux_eus:10.0\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10.0 Extended Update Support\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:4.16.0-5.el10_0.9\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"fence-agents\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:4.2.1-129.el8_10.25\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"fence-agents\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:4.10.0-110.el9_8.2\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}, {\"status\": \"unaffected\", \"version\": \"0:4.10.0-98.el9_7.12\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"fence-agents\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_e4s:9.2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:4.10.0-43.el9_2.21\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"fence-agents\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_eus:9.4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9.4 Extended Update Support\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:4.10.0-62.el9_4.24\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"fence-agents\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_eus:9.6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9.6 Extended Update Support\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:4.10.0-86.el9_6.16\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"fence-agents\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ai_inference_server:3.3::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat AI Inference Server 3.3\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1775680192\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhaiis/vllm-cuda-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ai_inference_server:3.3::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat AI Inference Server 3.3\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1775680262\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhaiis/vllm-rocm-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ai_inference_server:3.3::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat AI Inference Server 3.3\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1775749857\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhaiis/model-opt-cuda-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2.5::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2.5\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1777394109\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ansible-automation-platform-25/gateway-rhel8\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2.5::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2.5\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1777403872\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ansible-automation-platform-25/lightspeed-rhel8\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2.6::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2.6\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1777296732\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ansible-automation-platform-26/eda-controller-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2.6::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2.6\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1777391447\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ansible-automation-platform-26/ee-supported-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2.6::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2.6\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1777311120\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ansible-automation-platform-26/gateway-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2.6::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2.6\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1777299023\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ansible-automation-platform-26/hub-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2.6::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2.6\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1777398576\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ansible-automation-platform-26/lightspeed-chatbot-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2.6::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2.6\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1777387242\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ansible-automation-platform-26/lightspeed-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2.6::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2.6\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1777311601\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ansible-automation-platform-26/mcp-tools-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux_ai:3.3::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AI 3.3\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1776871984\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhelai3/bootc-aws-cuda-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux_ai:3.3::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AI 3.3\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1776871985\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhelai3/bootc-azure-cuda-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux_ai:3.3::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AI 3.3\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1776872005\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhelai3/bootc-azure-rocm-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux_ai:3.3::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AI 3.3\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1776773390\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhelai3/bootc-cuda-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux_ai:3.3::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AI 3.3\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1776871987\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhelai3/bootc-gcp-cuda-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux_ai:3.3::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AI 3.3\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1776773505\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhelai3/bootc-rocm-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux_ai:3.3::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AI 3.3\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1776938871\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhelai3/disk-image-cuda-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai:2.25::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI 2.25\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1776338381\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhoai/odh-feature-server-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai:2.25::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI 2.25\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1776343111\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhoai/odh-kserve-storage-initializer-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai:2.25::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI 2.25\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1780069069\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhoai/odh-vllm-gaudi-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai:2.25::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI 2.25\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1783696512\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai:2.25::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI 2.25\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1783616068\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai:2.25::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI 2.25\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1783998551\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai:2.25::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI 2.25\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1783664916\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai:2.25::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI 2.25\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1783615385\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai:2.25::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI 2.25\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1783664921\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai:2.25::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI 2.25\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1783696507\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai:2.25::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI 2.25\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1783615414\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai:2.25::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI 2.25\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1783998585\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai:2.25::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI 2.25\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1783664921\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai:2.25::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI 2.25\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1783615165\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai:2.25::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI 2.25\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1783664921\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai:2.25::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI 2.25\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1783615432\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai:3.3::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI 3.3\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1778264363\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhoai/odh-vllm-cpu-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai:3.3::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI 3.3\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1778600187\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhoai/odh-vllm-gaudi-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai:3.3::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI 3.3\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1782472374\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhoai/odh-trustyai-garak-lls-provider-dsp-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:quay:3.10::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Quay 3.1\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1775169155\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"quay/quay-rhel8\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:quay:3.12::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Quay 3.12\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1775253092\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"quay/quay-rhel8\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:quay:3.15::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Quay 3.15\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1775169219\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"quay/quay-rhel8\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:quay:3.16::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Quay 3.16\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1779204086\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"quay/quay-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:quay:3.9::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Quay 3.9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1775169218\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"quay/quay-rhel8\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite:6.18::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6.18\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1780414237\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"satellite/iop-host-inventory-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:trusted_artifact_signer:1.4::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Trusted Artifact Signer 1.4\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1775815407\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhtas/model-transparency-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_lightspeed\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Lightspeed\", \"packageName\": \"openshift-lightspeed/lightspeed-ocp-rag-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_lightspeed\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Lightspeed\", \"packageName\": \"openshift-lightspeed/lightspeed-service-api-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_lightspeed\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Lightspeed\", \"packageName\": \"openshift-lightspeed/lightspeed-to-dataverse-exporter-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ai_inference_server:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat AI Inference Server\", \"packageName\": \"rhaiis/vllm-cpu-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ai_inference_server:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat AI Inference Server\", \"packageName\": \"rhaiis/vllm-tpu-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2\", \"packageName\": \"ansible-automation-platform-24/ee-supported-rhel8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2\", \"packageName\": \"ansible-automation-platform-24/platform-resource-runner-rhel8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2\", \"packageName\": \"ansible-automation-platform-25/ee-supported-rhel8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2\", \"packageName\": \"ansible-automation-platform-25/lightspeed-chatbot-rhel8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2\", \"packageName\": \"ansible-automation-platform-26/controller-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2\", \"packageName\": \"ansible-automation-platform/automation-dashboard-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2\", \"packageName\": \"ansible-automation-platform-tech-preview/automation-dashboard-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-kserve-agent-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-kserve-controller-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-kserve-router-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-llama-stack-core-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-mlflow-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-workbench-jupyter-minimal-rocm-py312-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite:6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6\", \"packageName\": \"satellite/foreman-mcp-server-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:trusted_artifact_signer:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Trusted Artifact Signer\", \"packageName\": \"rhtas/segment-reporting-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-03-12T22:01:29.967Z\", \"value\": \"Reported to Red Hat.\"}, {\"lang\": \"en\", \"time\": \"2026-03-12T21:41:50.427Z\", \"value\": \"Made public.\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"RHSA-2026:13512: Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:13508: Red Hat Ansible Automation Platform 2.6 for RHEL 9\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:17083: Red Hat Enterprise Linux AppStream EUS (v. 10.0)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:13916: Red Hat Enterprise Linux AppStream (v. 10)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:19138: Red Hat Enterprise Linux AppStream (v. 10)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:12176: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux HighAvailability (v. 8), Red Hat Enterprise Linux ResilientStorage (v. 8)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:22330: Red Hat Enterprise Linux AppStream E4S (v.9.2), Red Hat Enterprise Linux High Availability E4S (v.9.2), Red Hat Enterprise Linux Resilient Storage E4S (v.9.2)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:21517: Red Hat Enterprise Linux AppStream EUS (v.9.4), Red Hat Enterprise Linux High Availability EUS (v.9.4), Red Hat Enterprise Linux Resilient Storage EUS (v.9.4)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:21431: Red Hat Enterprise Linux AppStream EUS (v.9.6)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:13672: Red Hat Enterprise Linux AppStream (v. 9)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:19355: Red Hat Enterprise Linux AppStream (v. 9)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:8748: Red Hat AI Inference Server 3.3\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:8746: Red Hat AI Inference Server 3.3\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:8747: Red Hat AI Inference Server 3.3\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:13553: Red Hat Ansible Automation Platform 2.5\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:13545: Red Hat Ansible Automation Platform 2.6\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:10140: Red Hat Enterprise Linux AI 3.3\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:10141: Red Hat Enterprise Linux AI 3.3\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:10184: Red Hat OpenShift AI 2.25\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:42644: Red Hat OpenShift AI 2.25\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:24977: Red Hat OpenShift AI 2.25\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:37275: Red Hat OpenShift AI 3.3\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:19712: Red Hat OpenShift AI 3.3\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:6720: Red Hat Quay 3.12\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:6568: Red Hat Quay 3.15\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:19375: Red Hat Quay 3.16\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:6912: Red Hat Quay 3.1\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:6926: Red Hat Quay 3.9\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:26226: Red Hat Satellite 6.18\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:8437: Red Hat Trusted Artifact Signer 1.4\"}], \"x_adpType\": \"supplier\", \"datePublic\": \"2026-03-12T21:41:50.427Z\", \"references\": [{\"url\": \"https://access.redhat.com/security/cve/CVE-2026-32597\", \"tags\": [\"vdb-entry\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=2447194\", \"name\": \"RHBZ#2447194\", \"tags\": [\"issue-tracking\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32597.json\", \"tags\": [\"x_sadp-csaf-vex\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:13512\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:13508\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:17083\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:13916\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:19138\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:12176\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:22330\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:21517\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:21431\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:13672\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:19355\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:8748\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:8746\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:8747\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:13553\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:13545\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:10140\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:10141\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:10184\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:42644\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:24977\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:37275\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:19712\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:6720\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:6568\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:19375\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:6912\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:6926\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:26226\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:8437\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.\"}], \"x_generator\": {\"engine\": \"sadp-cli 1.0.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A missing verification step has been discovered in PyJWT. PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 \\u00a74.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-347\", \"description\": \"Improper Verification of Cryptographic Signature\"}]}], \"providerMetadata\": {\"orgId\": \"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\", \"shortName\": \"redhat-SADP\", \"dateUpdated\": \"2026-08-03T12:05:42.693Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-32597\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-03-13T14:48:42.534762Z\"}}}], \"references\": [{\"url\": \"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-752w-5fwx-jx9f\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-03-13T14:48:58.019Z\"}}], \"cna\": {\"title\": \"PyJWT accepts unknown `crit` header extensions (RFC 7515 \\u00a74.1.11 MUST violation)\", \"source\": {\"advisory\": \"GHSA-752w-5fwx-jx9f\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"jpadilla\", \"product\": \"pyjwt\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 2.12.0\"}]}], \"references\": [{\"url\": \"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-752w-5fwx-jx9f\", \"name\": \"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-752w-5fwx-jx9f\", \"tags\": [\"x_refsource_CONFIRM\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 \\u00a74.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC. This vulnerability is fixed in 2.12.0.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-345\", \"description\": \"CWE-345: Insufficient Verification of Data Authenticity\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-863\", \"description\": \"CWE-863: Incorrect Authorization\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-03-12T21:41:50.427Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-32597\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-03T12:05:42.693Z\", \"dateReserved\": \"2026-03-12T14:54:24.269Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-03-12T21:41:50.427Z\", \"assignerShortName\": \"GitHub_M\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
RHSA-2026:6912
Vulnerability from csaf_redhat - Published: 2026-04-07 17:36 - Updated: 2026-08-08 16:05Summary
Red Hat Security Advisory: Red Hat Quay 3.10.20
Severity
Important
Notes
Topic: Red Hat Quay 3.10.20 is now available with bug fixes.
Details: Quay 3.10.20
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in jsrsasign. An attacker can exploit an incomplete comparison vulnerability in the getRandomBigIntegerZeroToMax and getRandomBigIntegerMinToMax functions. By manipulating incorrect comparison checks, an attacker can bias the Digital Signature Algorithm (DSA) nonces during signature generation. This allows the attacker to recover the private key, leading to a critical security compromise.
9.1 (Critical)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:a0b2026075e946fc046a6be46170a902051230d147061868209d559abd71981b_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:bb4c7f2f2f1d61d8bfcbf5a991d5faf417fb43ae189c3a008b367a3c2567121e_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:eae5ef47a0c9a80a074dd1e03d60ed54b2d53fe77753ba26cdc62f8d6d44f1f1_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:4dbc2192d14ddc31d6ca95e637852b762e5637e8bcdeff88955ee94c2599f8cd_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:982c6ba6d54fdd28de2c8e272426a2b7543a0a4d07ecc52cf2e42210708a8c60_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:f720639c165ca0ab66ff5065b6239f665de1f9f9dac825ee216c2964cb67d69b_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f10ae0b327ecd7dc04d10e378d92ad8ed707c74af76570e51a92a4b9b7e2da23_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:08fb4410b8b418429c02957af6b1395159b27429bbd36983b5a42f5650de26a5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:7bed37d976e23dc5866cfb97db4ba0da14e3bdfcb0619ffd00890ed2f0a87baa_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:c1a33f9ba0d8fb1b7bab9905e4e15d34d13a21b3bfea169a4b306147315148b7_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:c642d449979bc1f96c588a8763fe0e97a39d9a4ed5d093c8a114b46d79fc92d5_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:9222d6512b416186d1d5d0a051f3f873d5835c3942c368cbe79bbc24357ed0a5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-bundle@sha256:d562451f2b3de78ff747137f3c12f146e89f378608eaeec522a694fd8056fa17_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:029c488d9e828cc1e630ac1ff78f93a84d910d04138c541300cde0006ca2412e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0d1e82d1dd7c3bbcf73e6a04b6f853e50b99ef3557923fa9cbc44ff4bdaf4e95_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:e077bc427559e79bbbf67445a4790b7b0c75a86fc846278f25039df8139079c5_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in jsrsasign. An attacker can exploit improper verification of cryptographic signatures by supplying malicious domain parameters during the Digital Signature Algorithm (DSA) validation process. This allows the attacker to forge DSA signatures or X.509 certificates, which would then be accepted as legitimate, potentially leading to unauthorized access or data manipulation.
8.2 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:a0b2026075e946fc046a6be46170a902051230d147061868209d559abd71981b_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:bb4c7f2f2f1d61d8bfcbf5a991d5faf417fb43ae189c3a008b367a3c2567121e_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:eae5ef47a0c9a80a074dd1e03d60ed54b2d53fe77753ba26cdc62f8d6d44f1f1_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:4dbc2192d14ddc31d6ca95e637852b762e5637e8bcdeff88955ee94c2599f8cd_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:982c6ba6d54fdd28de2c8e272426a2b7543a0a4d07ecc52cf2e42210708a8c60_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:f720639c165ca0ab66ff5065b6239f665de1f9f9dac825ee216c2964cb67d69b_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f10ae0b327ecd7dc04d10e378d92ad8ed707c74af76570e51a92a4b9b7e2da23_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:08fb4410b8b418429c02957af6b1395159b27429bbd36983b5a42f5650de26a5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:7bed37d976e23dc5866cfb97db4ba0da14e3bdfcb0619ffd00890ed2f0a87baa_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:c1a33f9ba0d8fb1b7bab9905e4e15d34d13a21b3bfea169a4b306147315148b7_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:c642d449979bc1f96c588a8763fe0e97a39d9a4ed5d093c8a114b46d79fc92d5_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:9222d6512b416186d1d5d0a051f3f873d5835c3942c368cbe79bbc24357ed0a5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-bundle@sha256:d562451f2b3de78ff747137f3c12f146e89f378608eaeec522a694fd8056fa17_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:029c488d9e828cc1e630ac1ff78f93a84d910d04138c541300cde0006ca2412e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0d1e82d1dd7c3bbcf73e6a04b6f853e50b99ef3557923fa9cbc44ff4bdaf4e95_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:e077bc427559e79bbbf67445a4790b7b0c75a86fc846278f25039df8139079c5_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in jsrsasign. An attacker can exploit a missing cryptographic step in the Digital Signature Algorithm (DSA) signing process, specifically within the KJUR.crypto.DSA.signWithMessageHash function. By manipulating the signature generation to force specific values, the library emits an invalid signature without retrying. This vulnerability allows an attacker to recover the private key used for signing.
8.7 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:a0b2026075e946fc046a6be46170a902051230d147061868209d559abd71981b_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:bb4c7f2f2f1d61d8bfcbf5a991d5faf417fb43ae189c3a008b367a3c2567121e_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:eae5ef47a0c9a80a074dd1e03d60ed54b2d53fe77753ba26cdc62f8d6d44f1f1_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:4dbc2192d14ddc31d6ca95e637852b762e5637e8bcdeff88955ee94c2599f8cd_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:982c6ba6d54fdd28de2c8e272426a2b7543a0a4d07ecc52cf2e42210708a8c60_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:f720639c165ca0ab66ff5065b6239f665de1f9f9dac825ee216c2964cb67d69b_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f10ae0b327ecd7dc04d10e378d92ad8ed707c74af76570e51a92a4b9b7e2da23_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:08fb4410b8b418429c02957af6b1395159b27429bbd36983b5a42f5650de26a5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:7bed37d976e23dc5866cfb97db4ba0da14e3bdfcb0619ffd00890ed2f0a87baa_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:c1a33f9ba0d8fb1b7bab9905e4e15d34d13a21b3bfea169a4b306147315148b7_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:c642d449979bc1f96c588a8763fe0e97a39d9a4ed5d093c8a114b46d79fc92d5_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:9222d6512b416186d1d5d0a051f3f873d5835c3942c368cbe79bbc24357ed0a5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-bundle@sha256:d562451f2b3de78ff747137f3c12f146e89f378608eaeec522a694fd8056fa17_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:029c488d9e828cc1e630ac1ff78f93a84d910d04138c541300cde0006ca2412e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0d1e82d1dd7c3bbcf73e6a04b6f853e50b99ef3557923fa9cbc44ff4bdaf4e95_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:e077bc427559e79bbbf67445a4790b7b0c75a86fc846278f25039df8139079c5_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in jsrsasign. A remote attacker can exploit an incorrect conversion between numeric types by providing a negative exponent to the `modPow` function. This vulnerability can force the computation of incorrect modular inverses, which ultimately allows an attacker to bypass signature verification.
7.5 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:a0b2026075e946fc046a6be46170a902051230d147061868209d559abd71981b_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:bb4c7f2f2f1d61d8bfcbf5a991d5faf417fb43ae189c3a008b367a3c2567121e_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:eae5ef47a0c9a80a074dd1e03d60ed54b2d53fe77753ba26cdc62f8d6d44f1f1_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:4dbc2192d14ddc31d6ca95e637852b762e5637e8bcdeff88955ee94c2599f8cd_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:982c6ba6d54fdd28de2c8e272426a2b7543a0a4d07ecc52cf2e42210708a8c60_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:f720639c165ca0ab66ff5065b6239f665de1f9f9dac825ee216c2964cb67d69b_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f10ae0b327ecd7dc04d10e378d92ad8ed707c74af76570e51a92a4b9b7e2da23_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:08fb4410b8b418429c02957af6b1395159b27429bbd36983b5a42f5650de26a5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:7bed37d976e23dc5866cfb97db4ba0da14e3bdfcb0619ffd00890ed2f0a87baa_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:c1a33f9ba0d8fb1b7bab9905e4e15d34d13a21b3bfea169a4b306147315148b7_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:c642d449979bc1f96c588a8763fe0e97a39d9a4ed5d093c8a114b46d79fc92d5_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:9222d6512b416186d1d5d0a051f3f873d5835c3942c368cbe79bbc24357ed0a5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-bundle@sha256:d562451f2b3de78ff747137f3c12f146e89f378608eaeec522a694fd8056fa17_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:029c488d9e828cc1e630ac1ff78f93a84d910d04138c541300cde0006ca2412e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0d1e82d1dd7c3bbcf73e6a04b6f853e50b99ef3557923fa9cbc44ff4bdaf4e95_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:e077bc427559e79bbbf67445a4790b7b0c75a86fc846278f25039df8139079c5_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Authlib, a Python library used for building OAuth and OpenID Connect (OIDC) servers. This vulnerability allows a remote attacker to bypass critical integrity checks in OIDC ID Tokens. Specifically, the library's internal hash verification logic fails open when encountering an unsupported cryptographic algorithm, accepting a forged ID Token as valid. This can lead to an authentication bypass, granting unauthorized access to systems relying on Authlib for OIDC authentication.
9.1 (Critical)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:a0b2026075e946fc046a6be46170a902051230d147061868209d559abd71981b_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:bb4c7f2f2f1d61d8bfcbf5a991d5faf417fb43ae189c3a008b367a3c2567121e_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:eae5ef47a0c9a80a074dd1e03d60ed54b2d53fe77753ba26cdc62f8d6d44f1f1_amd64 | — |
Vendor Fix
fix
|
Known not affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:4dbc2192d14ddc31d6ca95e637852b762e5637e8bcdeff88955ee94c2599f8cd_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:982c6ba6d54fdd28de2c8e272426a2b7543a0a4d07ecc52cf2e42210708a8c60_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:f720639c165ca0ab66ff5065b6239f665de1f9f9dac825ee216c2964cb67d69b_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f10ae0b327ecd7dc04d10e378d92ad8ed707c74af76570e51a92a4b9b7e2da23_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:08fb4410b8b418429c02957af6b1395159b27429bbd36983b5a42f5650de26a5_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:7bed37d976e23dc5866cfb97db4ba0da14e3bdfcb0619ffd00890ed2f0a87baa_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:c1a33f9ba0d8fb1b7bab9905e4e15d34d13a21b3bfea169a4b306147315148b7_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:c642d449979bc1f96c588a8763fe0e97a39d9a4ed5d093c8a114b46d79fc92d5_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:9222d6512b416186d1d5d0a051f3f873d5835c3942c368cbe79bbc24357ed0a5_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-bundle@sha256:d562451f2b3de78ff747137f3c12f146e89f378608eaeec522a694fd8056fa17_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:029c488d9e828cc1e630ac1ff78f93a84d910d04138c541300cde0006ca2412e_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0d1e82d1dd7c3bbcf73e6a04b6f853e50b99ef3557923fa9cbc44ff4bdaf4e95_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:e077bc427559e79bbbf67445a4790b7b0c75a86fc846278f25039df8139079c5_amd64 | — |
Threats
Impact
Important
An unbounded recursion flaw has been discovered in the pypi pyasn1 library. This uncontrolled recursion occurs when decoding ASN.1 data with deeply nested structures. An attacker can supply a crafted payload containing nested SEQUENCE (0x30) or SET (0x31) tags with Indefinite Length (0x80) markers. This forces the decoder to recursively call itself until the Python interpreter crashes with a RecursionError or consumes all available memory (OOM), crashing the host application.
7.5 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:a0b2026075e946fc046a6be46170a902051230d147061868209d559abd71981b_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:bb4c7f2f2f1d61d8bfcbf5a991d5faf417fb43ae189c3a008b367a3c2567121e_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:eae5ef47a0c9a80a074dd1e03d60ed54b2d53fe77753ba26cdc62f8d6d44f1f1_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:4dbc2192d14ddc31d6ca95e637852b762e5637e8bcdeff88955ee94c2599f8cd_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:982c6ba6d54fdd28de2c8e272426a2b7543a0a4d07ecc52cf2e42210708a8c60_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:f720639c165ca0ab66ff5065b6239f665de1f9f9dac825ee216c2964cb67d69b_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f10ae0b327ecd7dc04d10e378d92ad8ed707c74af76570e51a92a4b9b7e2da23_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:08fb4410b8b418429c02957af6b1395159b27429bbd36983b5a42f5650de26a5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:7bed37d976e23dc5866cfb97db4ba0da14e3bdfcb0619ffd00890ed2f0a87baa_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:c1a33f9ba0d8fb1b7bab9905e4e15d34d13a21b3bfea169a4b306147315148b7_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:c642d449979bc1f96c588a8763fe0e97a39d9a4ed5d093c8a114b46d79fc92d5_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:9222d6512b416186d1d5d0a051f3f873d5835c3942c368cbe79bbc24357ed0a5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-bundle@sha256:d562451f2b3de78ff747137f3c12f146e89f378608eaeec522a694fd8056fa17_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:029c488d9e828cc1e630ac1ff78f93a84d910d04138c541300cde0006ca2412e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0d1e82d1dd7c3bbcf73e6a04b6f853e50b99ef3557923fa9cbc44ff4bdaf4e95_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:e077bc427559e79bbbf67445a4790b7b0c75a86fc846278f25039df8139079c5_amd64 | — |
Workaround
|
Threats
Impact
Important
A missing verification step has been discovered in PyJWT. PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC.
7.5 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:a0b2026075e946fc046a6be46170a902051230d147061868209d559abd71981b_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:bb4c7f2f2f1d61d8bfcbf5a991d5faf417fb43ae189c3a008b367a3c2567121e_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:eae5ef47a0c9a80a074dd1e03d60ed54b2d53fe77753ba26cdc62f8d6d44f1f1_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:4dbc2192d14ddc31d6ca95e637852b762e5637e8bcdeff88955ee94c2599f8cd_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:982c6ba6d54fdd28de2c8e272426a2b7543a0a4d07ecc52cf2e42210708a8c60_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:f720639c165ca0ab66ff5065b6239f665de1f9f9dac825ee216c2964cb67d69b_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f10ae0b327ecd7dc04d10e378d92ad8ed707c74af76570e51a92a4b9b7e2da23_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:08fb4410b8b418429c02957af6b1395159b27429bbd36983b5a42f5650de26a5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:7bed37d976e23dc5866cfb97db4ba0da14e3bdfcb0619ffd00890ed2f0a87baa_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:c1a33f9ba0d8fb1b7bab9905e4e15d34d13a21b3bfea169a4b306147315148b7_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:c642d449979bc1f96c588a8763fe0e97a39d9a4ed5d093c8a114b46d79fc92d5_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:9222d6512b416186d1d5d0a051f3f873d5835c3942c368cbe79bbc24357ed0a5_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-bundle@sha256:d562451f2b3de78ff747137f3c12f146e89f378608eaeec522a694fd8056fa17_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:029c488d9e828cc1e630ac1ff78f93a84d910d04138c541300cde0006ca2412e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0d1e82d1dd7c3bbcf73e6a04b6f853e50b99ef3557923fa9cbc44ff4bdaf4e95_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:e077bc427559e79bbbf67445a4790b7b0c75a86fc846278f25039df8139079c5_amd64 | — |
Workaround
|
Threats
Impact
Important
References
60 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat Quay 3.10.20 is now available with bug fixes.",
"title": "Topic"
},
{
"category": "general",
"text": "Quay 3.10.20",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:6912",
"url": "https://access.redhat.com/errata/RHSA-2026:6912"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-28498",
"url": "https://access.redhat.com/security/cve/CVE-2026-28498"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-30922",
"url": "https://access.redhat.com/security/cve/CVE-2026-30922"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32597",
"url": "https://access.redhat.com/security/cve/CVE-2026-32597"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-4599",
"url": "https://access.redhat.com/security/cve/CVE-2026-4599"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-4600",
"url": "https://access.redhat.com/security/cve/CVE-2026-4600"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-4601",
"url": "https://access.redhat.com/security/cve/CVE-2026-4601"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-4602",
"url": "https://access.redhat.com/security/cve/CVE-2026-4602"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_6912.json"
}
],
"title": "Red Hat Security Advisory: Red Hat Quay 3.10.20",
"tracking": {
"current_release_date": "2026-08-08T16:05:20+00:00",
"generator": {
"date": "2026-08-08T16:05:20+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.12"
}
},
"id": "RHSA-2026:6912",
"initial_release_date": "2026-04-07T17:36:52+00:00",
"revision_history": [
{
"date": "2026-04-07T17:36:52+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-08-08T04:36:23+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-08T16:05:20+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Quay 3.1",
"product": {
"name": "Red Hat Quay 3.1",
"product_id": "Red Hat Quay 3.1",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:quay:3.10::el8"
}
}
}
],
"category": "product_family",
"name": "Red Hat Quay"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:9222d6512b416186d1d5d0a051f3f873d5835c3942c368cbe79bbc24357ed0a5_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:9222d6512b416186d1d5d0a051f3f873d5835c3942c368cbe79bbc24357ed0a5_amd64",
"product_id": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:9222d6512b416186d1d5d0a051f3f873d5835c3942c368cbe79bbc24357ed0a5_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-bundle@sha256%3A9222d6512b416186d1d5d0a051f3f873d5835c3942c368cbe79bbc24357ed0a5?arch=amd64\u0026repository_url=registry.redhat.io/quay\u0026tag=1774885559"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f10ae0b327ecd7dc04d10e378d92ad8ed707c74af76570e51a92a4b9b7e2da23_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f10ae0b327ecd7dc04d10e378d92ad8ed707c74af76570e51a92a4b9b7e2da23_amd64",
"product_id": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f10ae0b327ecd7dc04d10e378d92ad8ed707c74af76570e51a92a4b9b7e2da23_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-bundle@sha256%3Af10ae0b327ecd7dc04d10e378d92ad8ed707c74af76570e51a92a4b9b7e2da23?arch=amd64\u0026repository_url=registry.redhat.io/quay\u0026tag=1774885579"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:08fb4410b8b418429c02957af6b1395159b27429bbd36983b5a42f5650de26a5_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:08fb4410b8b418429c02957af6b1395159b27429bbd36983b5a42f5650de26a5_amd64",
"product_id": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:08fb4410b8b418429c02957af6b1395159b27429bbd36983b5a42f5650de26a5_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-qemu-rhcos-rhel8@sha256%3A08fb4410b8b418429c02957af6b1395159b27429bbd36983b5a42f5650de26a5?arch=amd64\u0026repository_url=registry.redhat.io/quay\u0026tag=1774886143"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:c1a33f9ba0d8fb1b7bab9905e4e15d34d13a21b3bfea169a4b306147315148b7_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:c1a33f9ba0d8fb1b7bab9905e4e15d34d13a21b3bfea169a4b306147315148b7_amd64",
"product_id": "registry.redhat.io/quay/quay-builder-rhel8@sha256:c1a33f9ba0d8fb1b7bab9905e4e15d34d13a21b3bfea169a4b306147315148b7_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-rhel8@sha256%3Ac1a33f9ba0d8fb1b7bab9905e4e15d34d13a21b3bfea169a4b306147315148b7?arch=amd64\u0026repository_url=registry.redhat.io/quay\u0026tag=1774885638"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/clair-rhel8@sha256:4dbc2192d14ddc31d6ca95e637852b762e5637e8bcdeff88955ee94c2599f8cd_amd64",
"product": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:4dbc2192d14ddc31d6ca95e637852b762e5637e8bcdeff88955ee94c2599f8cd_amd64",
"product_id": "registry.redhat.io/quay/clair-rhel8@sha256:4dbc2192d14ddc31d6ca95e637852b762e5637e8bcdeff88955ee94c2599f8cd_amd64",
"product_identification_helper": {
"purl": "pkg:oci/clair-rhel8@sha256%3A4dbc2192d14ddc31d6ca95e637852b762e5637e8bcdeff88955ee94c2599f8cd?arch=amd64\u0026repository_url=registry.redhat.io/quay\u0026tag=1774885592"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-operator-bundle@sha256:d562451f2b3de78ff747137f3c12f146e89f378608eaeec522a694fd8056fa17_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-operator-bundle@sha256:d562451f2b3de78ff747137f3c12f146e89f378608eaeec522a694fd8056fa17_amd64",
"product_id": "registry.redhat.io/quay/quay-operator-bundle@sha256:d562451f2b3de78ff747137f3c12f146e89f378608eaeec522a694fd8056fa17_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-bundle@sha256%3Ad562451f2b3de78ff747137f3c12f146e89f378608eaeec522a694fd8056fa17?arch=amd64\u0026repository_url=registry.redhat.io/quay\u0026tag=1775173011"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:e077bc427559e79bbbf67445a4790b7b0c75a86fc846278f25039df8139079c5_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:e077bc427559e79bbbf67445a4790b7b0c75a86fc846278f25039df8139079c5_amd64",
"product_id": "registry.redhat.io/quay/quay-operator-rhel8@sha256:e077bc427559e79bbbf67445a4790b7b0c75a86fc846278f25039df8139079c5_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-rhel8@sha256%3Ae077bc427559e79bbbf67445a4790b7b0c75a86fc846278f25039df8139079c5?arch=amd64\u0026repository_url=registry.redhat.io/quay\u0026tag=1774885636"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-rhel8@sha256:eae5ef47a0c9a80a074dd1e03d60ed54b2d53fe77753ba26cdc62f8d6d44f1f1_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:eae5ef47a0c9a80a074dd1e03d60ed54b2d53fe77753ba26cdc62f8d6d44f1f1_amd64",
"product_id": "registry.redhat.io/quay/quay-rhel8@sha256:eae5ef47a0c9a80a074dd1e03d60ed54b2d53fe77753ba26cdc62f8d6d44f1f1_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-rhel8@sha256%3Aeae5ef47a0c9a80a074dd1e03d60ed54b2d53fe77753ba26cdc62f8d6d44f1f1?arch=amd64\u0026repository_url=registry.redhat.io/quay\u0026tag=1775169155"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:7bed37d976e23dc5866cfb97db4ba0da14e3bdfcb0619ffd00890ed2f0a87baa_ppc64le",
"product": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:7bed37d976e23dc5866cfb97db4ba0da14e3bdfcb0619ffd00890ed2f0a87baa_ppc64le",
"product_id": "registry.redhat.io/quay/quay-builder-rhel8@sha256:7bed37d976e23dc5866cfb97db4ba0da14e3bdfcb0619ffd00890ed2f0a87baa_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-rhel8@sha256%3A7bed37d976e23dc5866cfb97db4ba0da14e3bdfcb0619ffd00890ed2f0a87baa?arch=ppc64le\u0026repository_url=registry.redhat.io/quay\u0026tag=1774885638"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/clair-rhel8@sha256:982c6ba6d54fdd28de2c8e272426a2b7543a0a4d07ecc52cf2e42210708a8c60_ppc64le",
"product": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:982c6ba6d54fdd28de2c8e272426a2b7543a0a4d07ecc52cf2e42210708a8c60_ppc64le",
"product_id": "registry.redhat.io/quay/clair-rhel8@sha256:982c6ba6d54fdd28de2c8e272426a2b7543a0a4d07ecc52cf2e42210708a8c60_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/clair-rhel8@sha256%3A982c6ba6d54fdd28de2c8e272426a2b7543a0a4d07ecc52cf2e42210708a8c60?arch=ppc64le\u0026repository_url=registry.redhat.io/quay\u0026tag=1774885592"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:0d1e82d1dd7c3bbcf73e6a04b6f853e50b99ef3557923fa9cbc44ff4bdaf4e95_ppc64le",
"product": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:0d1e82d1dd7c3bbcf73e6a04b6f853e50b99ef3557923fa9cbc44ff4bdaf4e95_ppc64le",
"product_id": "registry.redhat.io/quay/quay-operator-rhel8@sha256:0d1e82d1dd7c3bbcf73e6a04b6f853e50b99ef3557923fa9cbc44ff4bdaf4e95_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-rhel8@sha256%3A0d1e82d1dd7c3bbcf73e6a04b6f853e50b99ef3557923fa9cbc44ff4bdaf4e95?arch=ppc64le\u0026repository_url=registry.redhat.io/quay\u0026tag=1774885636"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-rhel8@sha256:a0b2026075e946fc046a6be46170a902051230d147061868209d559abd71981b_ppc64le",
"product": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:a0b2026075e946fc046a6be46170a902051230d147061868209d559abd71981b_ppc64le",
"product_id": "registry.redhat.io/quay/quay-rhel8@sha256:a0b2026075e946fc046a6be46170a902051230d147061868209d559abd71981b_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-rhel8@sha256%3Aa0b2026075e946fc046a6be46170a902051230d147061868209d559abd71981b?arch=ppc64le\u0026repository_url=registry.redhat.io/quay\u0026tag=1775169155"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:c642d449979bc1f96c588a8763fe0e97a39d9a4ed5d093c8a114b46d79fc92d5_s390x",
"product": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:c642d449979bc1f96c588a8763fe0e97a39d9a4ed5d093c8a114b46d79fc92d5_s390x",
"product_id": "registry.redhat.io/quay/quay-builder-rhel8@sha256:c642d449979bc1f96c588a8763fe0e97a39d9a4ed5d093c8a114b46d79fc92d5_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-rhel8@sha256%3Ac642d449979bc1f96c588a8763fe0e97a39d9a4ed5d093c8a114b46d79fc92d5?arch=s390x\u0026repository_url=registry.redhat.io/quay\u0026tag=1774885638"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/clair-rhel8@sha256:f720639c165ca0ab66ff5065b6239f665de1f9f9dac825ee216c2964cb67d69b_s390x",
"product": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:f720639c165ca0ab66ff5065b6239f665de1f9f9dac825ee216c2964cb67d69b_s390x",
"product_id": "registry.redhat.io/quay/clair-rhel8@sha256:f720639c165ca0ab66ff5065b6239f665de1f9f9dac825ee216c2964cb67d69b_s390x",
"product_identification_helper": {
"purl": "pkg:oci/clair-rhel8@sha256%3Af720639c165ca0ab66ff5065b6239f665de1f9f9dac825ee216c2964cb67d69b?arch=s390x\u0026repository_url=registry.redhat.io/quay\u0026tag=1774885592"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:029c488d9e828cc1e630ac1ff78f93a84d910d04138c541300cde0006ca2412e_s390x",
"product": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:029c488d9e828cc1e630ac1ff78f93a84d910d04138c541300cde0006ca2412e_s390x",
"product_id": "registry.redhat.io/quay/quay-operator-rhel8@sha256:029c488d9e828cc1e630ac1ff78f93a84d910d04138c541300cde0006ca2412e_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-rhel8@sha256%3A029c488d9e828cc1e630ac1ff78f93a84d910d04138c541300cde0006ca2412e?arch=s390x\u0026repository_url=registry.redhat.io/quay\u0026tag=1774885636"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-rhel8@sha256:bb4c7f2f2f1d61d8bfcbf5a991d5faf417fb43ae189c3a008b367a3c2567121e_s390x",
"product": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:bb4c7f2f2f1d61d8bfcbf5a991d5faf417fb43ae189c3a008b367a3c2567121e_s390x",
"product_id": "registry.redhat.io/quay/quay-rhel8@sha256:bb4c7f2f2f1d61d8bfcbf5a991d5faf417fb43ae189c3a008b367a3c2567121e_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-rhel8@sha256%3Abb4c7f2f2f1d61d8bfcbf5a991d5faf417fb43ae189c3a008b367a3c2567121e?arch=s390x\u0026repository_url=registry.redhat.io/quay\u0026tag=1775169155"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:4dbc2192d14ddc31d6ca95e637852b762e5637e8bcdeff88955ee94c2599f8cd_amd64 as a component of Red Hat Quay 3.1",
"product_id": "Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:4dbc2192d14ddc31d6ca95e637852b762e5637e8bcdeff88955ee94c2599f8cd_amd64"
},
"product_reference": "registry.redhat.io/quay/clair-rhel8@sha256:4dbc2192d14ddc31d6ca95e637852b762e5637e8bcdeff88955ee94c2599f8cd_amd64",
"relates_to_product_reference": "Red Hat Quay 3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:982c6ba6d54fdd28de2c8e272426a2b7543a0a4d07ecc52cf2e42210708a8c60_ppc64le as a component of Red Hat Quay 3.1",
"product_id": "Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:982c6ba6d54fdd28de2c8e272426a2b7543a0a4d07ecc52cf2e42210708a8c60_ppc64le"
},
"product_reference": "registry.redhat.io/quay/clair-rhel8@sha256:982c6ba6d54fdd28de2c8e272426a2b7543a0a4d07ecc52cf2e42210708a8c60_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:f720639c165ca0ab66ff5065b6239f665de1f9f9dac825ee216c2964cb67d69b_s390x as a component of Red Hat Quay 3.1",
"product_id": "Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:f720639c165ca0ab66ff5065b6239f665de1f9f9dac825ee216c2964cb67d69b_s390x"
},
"product_reference": "registry.redhat.io/quay/clair-rhel8@sha256:f720639c165ca0ab66ff5065b6239f665de1f9f9dac825ee216c2964cb67d69b_s390x",
"relates_to_product_reference": "Red Hat Quay 3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f10ae0b327ecd7dc04d10e378d92ad8ed707c74af76570e51a92a4b9b7e2da23_amd64 as a component of Red Hat Quay 3.1",
"product_id": "Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f10ae0b327ecd7dc04d10e378d92ad8ed707c74af76570e51a92a4b9b7e2da23_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f10ae0b327ecd7dc04d10e378d92ad8ed707c74af76570e51a92a4b9b7e2da23_amd64",
"relates_to_product_reference": "Red Hat Quay 3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:08fb4410b8b418429c02957af6b1395159b27429bbd36983b5a42f5650de26a5_amd64 as a component of Red Hat Quay 3.1",
"product_id": "Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:08fb4410b8b418429c02957af6b1395159b27429bbd36983b5a42f5650de26a5_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:08fb4410b8b418429c02957af6b1395159b27429bbd36983b5a42f5650de26a5_amd64",
"relates_to_product_reference": "Red Hat Quay 3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:7bed37d976e23dc5866cfb97db4ba0da14e3bdfcb0619ffd00890ed2f0a87baa_ppc64le as a component of Red Hat Quay 3.1",
"product_id": "Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:7bed37d976e23dc5866cfb97db4ba0da14e3bdfcb0619ffd00890ed2f0a87baa_ppc64le"
},
"product_reference": "registry.redhat.io/quay/quay-builder-rhel8@sha256:7bed37d976e23dc5866cfb97db4ba0da14e3bdfcb0619ffd00890ed2f0a87baa_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:c1a33f9ba0d8fb1b7bab9905e4e15d34d13a21b3bfea169a4b306147315148b7_amd64 as a component of Red Hat Quay 3.1",
"product_id": "Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:c1a33f9ba0d8fb1b7bab9905e4e15d34d13a21b3bfea169a4b306147315148b7_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-builder-rhel8@sha256:c1a33f9ba0d8fb1b7bab9905e4e15d34d13a21b3bfea169a4b306147315148b7_amd64",
"relates_to_product_reference": "Red Hat Quay 3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:c642d449979bc1f96c588a8763fe0e97a39d9a4ed5d093c8a114b46d79fc92d5_s390x as a component of Red Hat Quay 3.1",
"product_id": "Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:c642d449979bc1f96c588a8763fe0e97a39d9a4ed5d093c8a114b46d79fc92d5_s390x"
},
"product_reference": "registry.redhat.io/quay/quay-builder-rhel8@sha256:c642d449979bc1f96c588a8763fe0e97a39d9a4ed5d093c8a114b46d79fc92d5_s390x",
"relates_to_product_reference": "Red Hat Quay 3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:9222d6512b416186d1d5d0a051f3f873d5835c3942c368cbe79bbc24357ed0a5_amd64 as a component of Red Hat Quay 3.1",
"product_id": "Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:9222d6512b416186d1d5d0a051f3f873d5835c3942c368cbe79bbc24357ed0a5_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:9222d6512b416186d1d5d0a051f3f873d5835c3942c368cbe79bbc24357ed0a5_amd64",
"relates_to_product_reference": "Red Hat Quay 3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-operator-bundle@sha256:d562451f2b3de78ff747137f3c12f146e89f378608eaeec522a694fd8056fa17_amd64 as a component of Red Hat Quay 3.1",
"product_id": "Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-bundle@sha256:d562451f2b3de78ff747137f3c12f146e89f378608eaeec522a694fd8056fa17_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-operator-bundle@sha256:d562451f2b3de78ff747137f3c12f146e89f378608eaeec522a694fd8056fa17_amd64",
"relates_to_product_reference": "Red Hat Quay 3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:029c488d9e828cc1e630ac1ff78f93a84d910d04138c541300cde0006ca2412e_s390x as a component of Red Hat Quay 3.1",
"product_id": "Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:029c488d9e828cc1e630ac1ff78f93a84d910d04138c541300cde0006ca2412e_s390x"
},
"product_reference": "registry.redhat.io/quay/quay-operator-rhel8@sha256:029c488d9e828cc1e630ac1ff78f93a84d910d04138c541300cde0006ca2412e_s390x",
"relates_to_product_reference": "Red Hat Quay 3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:0d1e82d1dd7c3bbcf73e6a04b6f853e50b99ef3557923fa9cbc44ff4bdaf4e95_ppc64le as a component of Red Hat Quay 3.1",
"product_id": "Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0d1e82d1dd7c3bbcf73e6a04b6f853e50b99ef3557923fa9cbc44ff4bdaf4e95_ppc64le"
},
"product_reference": "registry.redhat.io/quay/quay-operator-rhel8@sha256:0d1e82d1dd7c3bbcf73e6a04b6f853e50b99ef3557923fa9cbc44ff4bdaf4e95_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:e077bc427559e79bbbf67445a4790b7b0c75a86fc846278f25039df8139079c5_amd64 as a component of Red Hat Quay 3.1",
"product_id": "Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:e077bc427559e79bbbf67445a4790b7b0c75a86fc846278f25039df8139079c5_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-operator-rhel8@sha256:e077bc427559e79bbbf67445a4790b7b0c75a86fc846278f25039df8139079c5_amd64",
"relates_to_product_reference": "Red Hat Quay 3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:a0b2026075e946fc046a6be46170a902051230d147061868209d559abd71981b_ppc64le as a component of Red Hat Quay 3.1",
"product_id": "Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:a0b2026075e946fc046a6be46170a902051230d147061868209d559abd71981b_ppc64le"
},
"product_reference": "registry.redhat.io/quay/quay-rhel8@sha256:a0b2026075e946fc046a6be46170a902051230d147061868209d559abd71981b_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:bb4c7f2f2f1d61d8bfcbf5a991d5faf417fb43ae189c3a008b367a3c2567121e_s390x as a component of Red Hat Quay 3.1",
"product_id": "Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:bb4c7f2f2f1d61d8bfcbf5a991d5faf417fb43ae189c3a008b367a3c2567121e_s390x"
},
"product_reference": "registry.redhat.io/quay/quay-rhel8@sha256:bb4c7f2f2f1d61d8bfcbf5a991d5faf417fb43ae189c3a008b367a3c2567121e_s390x",
"relates_to_product_reference": "Red Hat Quay 3.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:eae5ef47a0c9a80a074dd1e03d60ed54b2d53fe77753ba26cdc62f8d6d44f1f1_amd64 as a component of Red Hat Quay 3.1",
"product_id": "Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:eae5ef47a0c9a80a074dd1e03d60ed54b2d53fe77753ba26cdc62f8d6d44f1f1_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-rhel8@sha256:eae5ef47a0c9a80a074dd1e03d60ed54b2d53fe77753ba26cdc62f8d6d44f1f1_amd64",
"relates_to_product_reference": "Red Hat Quay 3.1"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-4599",
"cwe": {
"id": "CWE-338",
"name": "Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)"
},
"discovery_date": "2026-03-23T06:01:34.008562+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:4dbc2192d14ddc31d6ca95e637852b762e5637e8bcdeff88955ee94c2599f8cd_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:982c6ba6d54fdd28de2c8e272426a2b7543a0a4d07ecc52cf2e42210708a8c60_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:f720639c165ca0ab66ff5065b6239f665de1f9f9dac825ee216c2964cb67d69b_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f10ae0b327ecd7dc04d10e378d92ad8ed707c74af76570e51a92a4b9b7e2da23_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:08fb4410b8b418429c02957af6b1395159b27429bbd36983b5a42f5650de26a5_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:7bed37d976e23dc5866cfb97db4ba0da14e3bdfcb0619ffd00890ed2f0a87baa_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:c1a33f9ba0d8fb1b7bab9905e4e15d34d13a21b3bfea169a4b306147315148b7_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:c642d449979bc1f96c588a8763fe0e97a39d9a4ed5d093c8a114b46d79fc92d5_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:9222d6512b416186d1d5d0a051f3f873d5835c3942c368cbe79bbc24357ed0a5_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-bundle@sha256:d562451f2b3de78ff747137f3c12f146e89f378608eaeec522a694fd8056fa17_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:029c488d9e828cc1e630ac1ff78f93a84d910d04138c541300cde0006ca2412e_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0d1e82d1dd7c3bbcf73e6a04b6f853e50b99ef3557923fa9cbc44ff4bdaf4e95_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:e077bc427559e79bbbf67445a4790b7b0c75a86fc846278f25039df8139079c5_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2450207"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jsrsasign. An attacker can exploit an incomplete comparison vulnerability in the getRandomBigIntegerZeroToMax and getRandomBigIntegerMinToMax functions. By manipulating incorrect comparison checks, an attacker can bias the Digital Signature Algorithm (DSA) nonces during signature generation. This allows the attacker to recover the private key, leading to a critical security compromise.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jsrsasign: jsrsasign: Private key recovery via incomplete comparison checks biasing DSA nonces",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:a0b2026075e946fc046a6be46170a902051230d147061868209d559abd71981b_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:bb4c7f2f2f1d61d8bfcbf5a991d5faf417fb43ae189c3a008b367a3c2567121e_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:eae5ef47a0c9a80a074dd1e03d60ed54b2d53fe77753ba26cdc62f8d6d44f1f1_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:4dbc2192d14ddc31d6ca95e637852b762e5637e8bcdeff88955ee94c2599f8cd_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:982c6ba6d54fdd28de2c8e272426a2b7543a0a4d07ecc52cf2e42210708a8c60_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:f720639c165ca0ab66ff5065b6239f665de1f9f9dac825ee216c2964cb67d69b_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f10ae0b327ecd7dc04d10e378d92ad8ed707c74af76570e51a92a4b9b7e2da23_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:08fb4410b8b418429c02957af6b1395159b27429bbd36983b5a42f5650de26a5_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:7bed37d976e23dc5866cfb97db4ba0da14e3bdfcb0619ffd00890ed2f0a87baa_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:c1a33f9ba0d8fb1b7bab9905e4e15d34d13a21b3bfea169a4b306147315148b7_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:c642d449979bc1f96c588a8763fe0e97a39d9a4ed5d093c8a114b46d79fc92d5_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:9222d6512b416186d1d5d0a051f3f873d5835c3942c368cbe79bbc24357ed0a5_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-bundle@sha256:d562451f2b3de78ff747137f3c12f146e89f378608eaeec522a694fd8056fa17_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:029c488d9e828cc1e630ac1ff78f93a84d910d04138c541300cde0006ca2412e_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0d1e82d1dd7c3bbcf73e6a04b6f853e50b99ef3557923fa9cbc44ff4bdaf4e95_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:e077bc427559e79bbbf67445a4790b7b0c75a86fc846278f25039df8139079c5_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4599"
},
{
"category": "external",
"summary": "RHBZ#2450207",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450207"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4599",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4599"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4599",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4599"
},
{
"category": "external",
"summary": "https://gist.github.com/Kr0emer/081681818b51605c91945126d74b4f20",
"url": "https://gist.github.com/Kr0emer/081681818b51605c91945126d74b4f20"
},
{
"category": "external",
"summary": "https://github.com/kjur/jsrsasign/commit/ee4b013478366cb16cea9a4bdfb218b6077f83b1",
"url": "https://github.com/kjur/jsrsasign/commit/ee4b013478366cb16cea9a4bdfb218b6077f83b1"
},
{
"category": "external",
"summary": "https://github.com/kjur/jsrsasign/pull/647",
"url": "https://github.com/kjur/jsrsasign/pull/647"
},
{
"category": "external",
"summary": "https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370939",
"url": "https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370939"
}
],
"release_date": "2026-03-23T05:00:12.522000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-07T17:36:52+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:a0b2026075e946fc046a6be46170a902051230d147061868209d559abd71981b_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:bb4c7f2f2f1d61d8bfcbf5a991d5faf417fb43ae189c3a008b367a3c2567121e_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:eae5ef47a0c9a80a074dd1e03d60ed54b2d53fe77753ba26cdc62f8d6d44f1f1_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:6912"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:4dbc2192d14ddc31d6ca95e637852b762e5637e8bcdeff88955ee94c2599f8cd_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:982c6ba6d54fdd28de2c8e272426a2b7543a0a4d07ecc52cf2e42210708a8c60_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:f720639c165ca0ab66ff5065b6239f665de1f9f9dac825ee216c2964cb67d69b_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f10ae0b327ecd7dc04d10e378d92ad8ed707c74af76570e51a92a4b9b7e2da23_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:08fb4410b8b418429c02957af6b1395159b27429bbd36983b5a42f5650de26a5_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:7bed37d976e23dc5866cfb97db4ba0da14e3bdfcb0619ffd00890ed2f0a87baa_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:c1a33f9ba0d8fb1b7bab9905e4e15d34d13a21b3bfea169a4b306147315148b7_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:c642d449979bc1f96c588a8763fe0e97a39d9a4ed5d093c8a114b46d79fc92d5_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:9222d6512b416186d1d5d0a051f3f873d5835c3942c368cbe79bbc24357ed0a5_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-bundle@sha256:d562451f2b3de78ff747137f3c12f146e89f378608eaeec522a694fd8056fa17_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:029c488d9e828cc1e630ac1ff78f93a84d910d04138c541300cde0006ca2412e_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0d1e82d1dd7c3bbcf73e6a04b6f853e50b99ef3557923fa9cbc44ff4bdaf4e95_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:e077bc427559e79bbbf67445a4790b7b0c75a86fc846278f25039df8139079c5_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:a0b2026075e946fc046a6be46170a902051230d147061868209d559abd71981b_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:bb4c7f2f2f1d61d8bfcbf5a991d5faf417fb43ae189c3a008b367a3c2567121e_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:eae5ef47a0c9a80a074dd1e03d60ed54b2d53fe77753ba26cdc62f8d6d44f1f1_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:4dbc2192d14ddc31d6ca95e637852b762e5637e8bcdeff88955ee94c2599f8cd_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:982c6ba6d54fdd28de2c8e272426a2b7543a0a4d07ecc52cf2e42210708a8c60_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:f720639c165ca0ab66ff5065b6239f665de1f9f9dac825ee216c2964cb67d69b_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f10ae0b327ecd7dc04d10e378d92ad8ed707c74af76570e51a92a4b9b7e2da23_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:08fb4410b8b418429c02957af6b1395159b27429bbd36983b5a42f5650de26a5_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:7bed37d976e23dc5866cfb97db4ba0da14e3bdfcb0619ffd00890ed2f0a87baa_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:c1a33f9ba0d8fb1b7bab9905e4e15d34d13a21b3bfea169a4b306147315148b7_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:c642d449979bc1f96c588a8763fe0e97a39d9a4ed5d093c8a114b46d79fc92d5_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:9222d6512b416186d1d5d0a051f3f873d5835c3942c368cbe79bbc24357ed0a5_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-bundle@sha256:d562451f2b3de78ff747137f3c12f146e89f378608eaeec522a694fd8056fa17_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:029c488d9e828cc1e630ac1ff78f93a84d910d04138c541300cde0006ca2412e_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0d1e82d1dd7c3bbcf73e6a04b6f853e50b99ef3557923fa9cbc44ff4bdaf4e95_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:e077bc427559e79bbbf67445a4790b7b0c75a86fc846278f25039df8139079c5_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:a0b2026075e946fc046a6be46170a902051230d147061868209d559abd71981b_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:bb4c7f2f2f1d61d8bfcbf5a991d5faf417fb43ae189c3a008b367a3c2567121e_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:eae5ef47a0c9a80a074dd1e03d60ed54b2d53fe77753ba26cdc62f8d6d44f1f1_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jsrsasign: jsrsasign: Private key recovery via incomplete comparison checks biasing DSA nonces"
},
{
"cve": "CVE-2026-4600",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-03-23T06:01:39.334925+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:4dbc2192d14ddc31d6ca95e637852b762e5637e8bcdeff88955ee94c2599f8cd_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:982c6ba6d54fdd28de2c8e272426a2b7543a0a4d07ecc52cf2e42210708a8c60_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:f720639c165ca0ab66ff5065b6239f665de1f9f9dac825ee216c2964cb67d69b_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f10ae0b327ecd7dc04d10e378d92ad8ed707c74af76570e51a92a4b9b7e2da23_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:08fb4410b8b418429c02957af6b1395159b27429bbd36983b5a42f5650de26a5_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:7bed37d976e23dc5866cfb97db4ba0da14e3bdfcb0619ffd00890ed2f0a87baa_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:c1a33f9ba0d8fb1b7bab9905e4e15d34d13a21b3bfea169a4b306147315148b7_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:c642d449979bc1f96c588a8763fe0e97a39d9a4ed5d093c8a114b46d79fc92d5_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:9222d6512b416186d1d5d0a051f3f873d5835c3942c368cbe79bbc24357ed0a5_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-bundle@sha256:d562451f2b3de78ff747137f3c12f146e89f378608eaeec522a694fd8056fa17_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:029c488d9e828cc1e630ac1ff78f93a84d910d04138c541300cde0006ca2412e_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0d1e82d1dd7c3bbcf73e6a04b6f853e50b99ef3557923fa9cbc44ff4bdaf4e95_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:e077bc427559e79bbbf67445a4790b7b0c75a86fc846278f25039df8139079c5_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2450208"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jsrsasign. An attacker can exploit improper verification of cryptographic signatures by supplying malicious domain parameters during the Digital Signature Algorithm (DSA) validation process. This allows the attacker to forge DSA signatures or X.509 certificates, which would then be accepted as legitimate, potentially leading to unauthorized access or data manipulation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jsrsasign: jsrsasign: Cryptographic signature forgery via malicious DSA domain parameters",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "IMPORTANT. The flaw in jsrsasign allows an attacker to forge Digital Signature Algorithm (DSA) signatures or X.509 certificates by providing malicious domain parameters during validation. This could lead to unauthorized access or data manipulation in affected Red Hat products such as Migration Toolkit for Virtualization and Red Hat Quay, where jsrsasign is utilized for cryptographic signature verification.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:a0b2026075e946fc046a6be46170a902051230d147061868209d559abd71981b_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:bb4c7f2f2f1d61d8bfcbf5a991d5faf417fb43ae189c3a008b367a3c2567121e_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:eae5ef47a0c9a80a074dd1e03d60ed54b2d53fe77753ba26cdc62f8d6d44f1f1_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:4dbc2192d14ddc31d6ca95e637852b762e5637e8bcdeff88955ee94c2599f8cd_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:982c6ba6d54fdd28de2c8e272426a2b7543a0a4d07ecc52cf2e42210708a8c60_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:f720639c165ca0ab66ff5065b6239f665de1f9f9dac825ee216c2964cb67d69b_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f10ae0b327ecd7dc04d10e378d92ad8ed707c74af76570e51a92a4b9b7e2da23_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:08fb4410b8b418429c02957af6b1395159b27429bbd36983b5a42f5650de26a5_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:7bed37d976e23dc5866cfb97db4ba0da14e3bdfcb0619ffd00890ed2f0a87baa_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:c1a33f9ba0d8fb1b7bab9905e4e15d34d13a21b3bfea169a4b306147315148b7_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:c642d449979bc1f96c588a8763fe0e97a39d9a4ed5d093c8a114b46d79fc92d5_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:9222d6512b416186d1d5d0a051f3f873d5835c3942c368cbe79bbc24357ed0a5_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-bundle@sha256:d562451f2b3de78ff747137f3c12f146e89f378608eaeec522a694fd8056fa17_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:029c488d9e828cc1e630ac1ff78f93a84d910d04138c541300cde0006ca2412e_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0d1e82d1dd7c3bbcf73e6a04b6f853e50b99ef3557923fa9cbc44ff4bdaf4e95_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:e077bc427559e79bbbf67445a4790b7b0c75a86fc846278f25039df8139079c5_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4600"
},
{
"category": "external",
"summary": "RHBZ#2450208",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450208"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4600",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4600"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4600",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4600"
},
{
"category": "external",
"summary": "https://gist.github.com/Kr0emer/bf15ddc097176e951659a24a8e9002a7",
"url": "https://gist.github.com/Kr0emer/bf15ddc097176e951659a24a8e9002a7"
},
{
"category": "external",
"summary": "https://github.com/kjur/jsrsasign/commit/37b4c06b145c7bfd6bc2a6df5d0a12c56b15ef60",
"url": "https://github.com/kjur/jsrsasign/commit/37b4c06b145c7bfd6bc2a6df5d0a12c56b15ef60"
},
{
"category": "external",
"summary": "https://github.com/kjur/jsrsasign/pull/646",
"url": "https://github.com/kjur/jsrsasign/pull/646"
},
{
"category": "external",
"summary": "https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370940",
"url": "https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370940"
}
],
"release_date": "2026-03-23T05:00:08.475000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-07T17:36:52+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:a0b2026075e946fc046a6be46170a902051230d147061868209d559abd71981b_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:bb4c7f2f2f1d61d8bfcbf5a991d5faf417fb43ae189c3a008b367a3c2567121e_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:eae5ef47a0c9a80a074dd1e03d60ed54b2d53fe77753ba26cdc62f8d6d44f1f1_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:6912"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:4dbc2192d14ddc31d6ca95e637852b762e5637e8bcdeff88955ee94c2599f8cd_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:982c6ba6d54fdd28de2c8e272426a2b7543a0a4d07ecc52cf2e42210708a8c60_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:f720639c165ca0ab66ff5065b6239f665de1f9f9dac825ee216c2964cb67d69b_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f10ae0b327ecd7dc04d10e378d92ad8ed707c74af76570e51a92a4b9b7e2da23_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:08fb4410b8b418429c02957af6b1395159b27429bbd36983b5a42f5650de26a5_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:7bed37d976e23dc5866cfb97db4ba0da14e3bdfcb0619ffd00890ed2f0a87baa_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:c1a33f9ba0d8fb1b7bab9905e4e15d34d13a21b3bfea169a4b306147315148b7_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:c642d449979bc1f96c588a8763fe0e97a39d9a4ed5d093c8a114b46d79fc92d5_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:9222d6512b416186d1d5d0a051f3f873d5835c3942c368cbe79bbc24357ed0a5_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-bundle@sha256:d562451f2b3de78ff747137f3c12f146e89f378608eaeec522a694fd8056fa17_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:029c488d9e828cc1e630ac1ff78f93a84d910d04138c541300cde0006ca2412e_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0d1e82d1dd7c3bbcf73e6a04b6f853e50b99ef3557923fa9cbc44ff4bdaf4e95_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:e077bc427559e79bbbf67445a4790b7b0c75a86fc846278f25039df8139079c5_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:a0b2026075e946fc046a6be46170a902051230d147061868209d559abd71981b_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:bb4c7f2f2f1d61d8bfcbf5a991d5faf417fb43ae189c3a008b367a3c2567121e_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:eae5ef47a0c9a80a074dd1e03d60ed54b2d53fe77753ba26cdc62f8d6d44f1f1_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:4dbc2192d14ddc31d6ca95e637852b762e5637e8bcdeff88955ee94c2599f8cd_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:982c6ba6d54fdd28de2c8e272426a2b7543a0a4d07ecc52cf2e42210708a8c60_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:f720639c165ca0ab66ff5065b6239f665de1f9f9dac825ee216c2964cb67d69b_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f10ae0b327ecd7dc04d10e378d92ad8ed707c74af76570e51a92a4b9b7e2da23_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:08fb4410b8b418429c02957af6b1395159b27429bbd36983b5a42f5650de26a5_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:7bed37d976e23dc5866cfb97db4ba0da14e3bdfcb0619ffd00890ed2f0a87baa_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:c1a33f9ba0d8fb1b7bab9905e4e15d34d13a21b3bfea169a4b306147315148b7_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:c642d449979bc1f96c588a8763fe0e97a39d9a4ed5d093c8a114b46d79fc92d5_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:9222d6512b416186d1d5d0a051f3f873d5835c3942c368cbe79bbc24357ed0a5_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-bundle@sha256:d562451f2b3de78ff747137f3c12f146e89f378608eaeec522a694fd8056fa17_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:029c488d9e828cc1e630ac1ff78f93a84d910d04138c541300cde0006ca2412e_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0d1e82d1dd7c3bbcf73e6a04b6f853e50b99ef3557923fa9cbc44ff4bdaf4e95_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:e077bc427559e79bbbf67445a4790b7b0c75a86fc846278f25039df8139079c5_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:a0b2026075e946fc046a6be46170a902051230d147061868209d559abd71981b_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:bb4c7f2f2f1d61d8bfcbf5a991d5faf417fb43ae189c3a008b367a3c2567121e_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:eae5ef47a0c9a80a074dd1e03d60ed54b2d53fe77753ba26cdc62f8d6d44f1f1_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jsrsasign: jsrsasign: Cryptographic signature forgery via malicious DSA domain parameters"
},
{
"cve": "CVE-2026-4601",
"cwe": {
"id": "CWE-325",
"name": "Missing Cryptographic Step"
},
"discovery_date": "2026-03-23T06:01:44.014846+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:4dbc2192d14ddc31d6ca95e637852b762e5637e8bcdeff88955ee94c2599f8cd_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:982c6ba6d54fdd28de2c8e272426a2b7543a0a4d07ecc52cf2e42210708a8c60_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:f720639c165ca0ab66ff5065b6239f665de1f9f9dac825ee216c2964cb67d69b_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f10ae0b327ecd7dc04d10e378d92ad8ed707c74af76570e51a92a4b9b7e2da23_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:08fb4410b8b418429c02957af6b1395159b27429bbd36983b5a42f5650de26a5_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:7bed37d976e23dc5866cfb97db4ba0da14e3bdfcb0619ffd00890ed2f0a87baa_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:c1a33f9ba0d8fb1b7bab9905e4e15d34d13a21b3bfea169a4b306147315148b7_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:c642d449979bc1f96c588a8763fe0e97a39d9a4ed5d093c8a114b46d79fc92d5_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:9222d6512b416186d1d5d0a051f3f873d5835c3942c368cbe79bbc24357ed0a5_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-bundle@sha256:d562451f2b3de78ff747137f3c12f146e89f378608eaeec522a694fd8056fa17_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:029c488d9e828cc1e630ac1ff78f93a84d910d04138c541300cde0006ca2412e_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0d1e82d1dd7c3bbcf73e6a04b6f853e50b99ef3557923fa9cbc44ff4bdaf4e95_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:e077bc427559e79bbbf67445a4790b7b0c75a86fc846278f25039df8139079c5_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2450209"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jsrsasign. An attacker can exploit a missing cryptographic step in the Digital Signature Algorithm (DSA) signing process, specifically within the KJUR.crypto.DSA.signWithMessageHash function. By manipulating the signature generation to force specific values, the library emits an invalid signature without retrying. This vulnerability allows an attacker to recover the private key used for signing.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jsrsasign: jsrsasign: Private Key Recovery via Missing Cryptographic Step in DSA Signing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "IMPORTANT: A flaw in the jsrsasign library allows for private key recovery due to a missing cryptographic step in the Digital Signature Algorithm (DSA) signing process. An attacker can manipulate signature generation within the KJUR.crypto.DSA.signWithMessageHash function to force specific values, enabling the recovery of the private key. This impacts Red Hat products utilizing jsrsasign, such as Migration Toolkit for Virtualization and Red Hat Quay.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:a0b2026075e946fc046a6be46170a902051230d147061868209d559abd71981b_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:bb4c7f2f2f1d61d8bfcbf5a991d5faf417fb43ae189c3a008b367a3c2567121e_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:eae5ef47a0c9a80a074dd1e03d60ed54b2d53fe77753ba26cdc62f8d6d44f1f1_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:4dbc2192d14ddc31d6ca95e637852b762e5637e8bcdeff88955ee94c2599f8cd_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:982c6ba6d54fdd28de2c8e272426a2b7543a0a4d07ecc52cf2e42210708a8c60_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:f720639c165ca0ab66ff5065b6239f665de1f9f9dac825ee216c2964cb67d69b_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f10ae0b327ecd7dc04d10e378d92ad8ed707c74af76570e51a92a4b9b7e2da23_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:08fb4410b8b418429c02957af6b1395159b27429bbd36983b5a42f5650de26a5_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:7bed37d976e23dc5866cfb97db4ba0da14e3bdfcb0619ffd00890ed2f0a87baa_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:c1a33f9ba0d8fb1b7bab9905e4e15d34d13a21b3bfea169a4b306147315148b7_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:c642d449979bc1f96c588a8763fe0e97a39d9a4ed5d093c8a114b46d79fc92d5_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:9222d6512b416186d1d5d0a051f3f873d5835c3942c368cbe79bbc24357ed0a5_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-bundle@sha256:d562451f2b3de78ff747137f3c12f146e89f378608eaeec522a694fd8056fa17_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:029c488d9e828cc1e630ac1ff78f93a84d910d04138c541300cde0006ca2412e_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0d1e82d1dd7c3bbcf73e6a04b6f853e50b99ef3557923fa9cbc44ff4bdaf4e95_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:e077bc427559e79bbbf67445a4790b7b0c75a86fc846278f25039df8139079c5_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4601"
},
{
"category": "external",
"summary": "RHBZ#2450209",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450209"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4601",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4601"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4601",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4601"
},
{
"category": "external",
"summary": "https://gist.github.com/Kr0emer/93789fe6efe5519db9692d4ad1dad586",
"url": "https://gist.github.com/Kr0emer/93789fe6efe5519db9692d4ad1dad586"
},
{
"category": "external",
"summary": "https://github.com/kjur/jsrsasign/commit/0710e392ec35de697ce11e4219c988ba2b5fe0eb",
"url": "https://github.com/kjur/jsrsasign/commit/0710e392ec35de697ce11e4219c988ba2b5fe0eb"
},
{
"category": "external",
"summary": "https://github.com/kjur/jsrsasign/pull/645",
"url": "https://github.com/kjur/jsrsasign/pull/645"
},
{
"category": "external",
"summary": "https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370941",
"url": "https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370941"
}
],
"release_date": "2026-03-23T05:00:13.312000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-07T17:36:52+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:a0b2026075e946fc046a6be46170a902051230d147061868209d559abd71981b_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:bb4c7f2f2f1d61d8bfcbf5a991d5faf417fb43ae189c3a008b367a3c2567121e_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:eae5ef47a0c9a80a074dd1e03d60ed54b2d53fe77753ba26cdc62f8d6d44f1f1_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:6912"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:4dbc2192d14ddc31d6ca95e637852b762e5637e8bcdeff88955ee94c2599f8cd_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:982c6ba6d54fdd28de2c8e272426a2b7543a0a4d07ecc52cf2e42210708a8c60_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:f720639c165ca0ab66ff5065b6239f665de1f9f9dac825ee216c2964cb67d69b_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f10ae0b327ecd7dc04d10e378d92ad8ed707c74af76570e51a92a4b9b7e2da23_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:08fb4410b8b418429c02957af6b1395159b27429bbd36983b5a42f5650de26a5_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:7bed37d976e23dc5866cfb97db4ba0da14e3bdfcb0619ffd00890ed2f0a87baa_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:c1a33f9ba0d8fb1b7bab9905e4e15d34d13a21b3bfea169a4b306147315148b7_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:c642d449979bc1f96c588a8763fe0e97a39d9a4ed5d093c8a114b46d79fc92d5_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:9222d6512b416186d1d5d0a051f3f873d5835c3942c368cbe79bbc24357ed0a5_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-bundle@sha256:d562451f2b3de78ff747137f3c12f146e89f378608eaeec522a694fd8056fa17_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:029c488d9e828cc1e630ac1ff78f93a84d910d04138c541300cde0006ca2412e_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0d1e82d1dd7c3bbcf73e6a04b6f853e50b99ef3557923fa9cbc44ff4bdaf4e95_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:e077bc427559e79bbbf67445a4790b7b0c75a86fc846278f25039df8139079c5_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:a0b2026075e946fc046a6be46170a902051230d147061868209d559abd71981b_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:bb4c7f2f2f1d61d8bfcbf5a991d5faf417fb43ae189c3a008b367a3c2567121e_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:eae5ef47a0c9a80a074dd1e03d60ed54b2d53fe77753ba26cdc62f8d6d44f1f1_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:4dbc2192d14ddc31d6ca95e637852b762e5637e8bcdeff88955ee94c2599f8cd_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:982c6ba6d54fdd28de2c8e272426a2b7543a0a4d07ecc52cf2e42210708a8c60_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:f720639c165ca0ab66ff5065b6239f665de1f9f9dac825ee216c2964cb67d69b_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f10ae0b327ecd7dc04d10e378d92ad8ed707c74af76570e51a92a4b9b7e2da23_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:08fb4410b8b418429c02957af6b1395159b27429bbd36983b5a42f5650de26a5_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:7bed37d976e23dc5866cfb97db4ba0da14e3bdfcb0619ffd00890ed2f0a87baa_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:c1a33f9ba0d8fb1b7bab9905e4e15d34d13a21b3bfea169a4b306147315148b7_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:c642d449979bc1f96c588a8763fe0e97a39d9a4ed5d093c8a114b46d79fc92d5_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:9222d6512b416186d1d5d0a051f3f873d5835c3942c368cbe79bbc24357ed0a5_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-bundle@sha256:d562451f2b3de78ff747137f3c12f146e89f378608eaeec522a694fd8056fa17_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:029c488d9e828cc1e630ac1ff78f93a84d910d04138c541300cde0006ca2412e_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0d1e82d1dd7c3bbcf73e6a04b6f853e50b99ef3557923fa9cbc44ff4bdaf4e95_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:e077bc427559e79bbbf67445a4790b7b0c75a86fc846278f25039df8139079c5_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:a0b2026075e946fc046a6be46170a902051230d147061868209d559abd71981b_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:bb4c7f2f2f1d61d8bfcbf5a991d5faf417fb43ae189c3a008b367a3c2567121e_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:eae5ef47a0c9a80a074dd1e03d60ed54b2d53fe77753ba26cdc62f8d6d44f1f1_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jsrsasign: jsrsasign: Private Key Recovery via Missing Cryptographic Step in DSA Signing"
},
{
"cve": "CVE-2026-4602",
"cwe": {
"id": "CWE-681",
"name": "Incorrect Conversion between Numeric Types"
},
"discovery_date": "2026-03-23T06:01:28.729668+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:4dbc2192d14ddc31d6ca95e637852b762e5637e8bcdeff88955ee94c2599f8cd_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:982c6ba6d54fdd28de2c8e272426a2b7543a0a4d07ecc52cf2e42210708a8c60_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:f720639c165ca0ab66ff5065b6239f665de1f9f9dac825ee216c2964cb67d69b_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f10ae0b327ecd7dc04d10e378d92ad8ed707c74af76570e51a92a4b9b7e2da23_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:08fb4410b8b418429c02957af6b1395159b27429bbd36983b5a42f5650de26a5_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:7bed37d976e23dc5866cfb97db4ba0da14e3bdfcb0619ffd00890ed2f0a87baa_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:c1a33f9ba0d8fb1b7bab9905e4e15d34d13a21b3bfea169a4b306147315148b7_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:c642d449979bc1f96c588a8763fe0e97a39d9a4ed5d093c8a114b46d79fc92d5_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:9222d6512b416186d1d5d0a051f3f873d5835c3942c368cbe79bbc24357ed0a5_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-bundle@sha256:d562451f2b3de78ff747137f3c12f146e89f378608eaeec522a694fd8056fa17_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:029c488d9e828cc1e630ac1ff78f93a84d910d04138c541300cde0006ca2412e_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0d1e82d1dd7c3bbcf73e6a04b6f853e50b99ef3557923fa9cbc44ff4bdaf4e95_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:e077bc427559e79bbbf67445a4790b7b0c75a86fc846278f25039df8139079c5_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2450206"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jsrsasign. A remote attacker can exploit an incorrect conversion between numeric types by providing a negative exponent to the `modPow` function. This vulnerability can force the computation of incorrect modular inverses, which ultimately allows an attacker to bypass signature verification.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jsrsasign: jsrsasign: Signature verification bypass via negative exponent handling",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an IMPORTANT flaw. The `jsrsasign` library, as used in Red Hat products such as Migration Toolkit for Virtualization and Red Hat Quay, is vulnerable to a signature verification bypass. A remote attacker could provide a specially crafted negative exponent to the `modPow` function, leading to incorrect modular inverse computations and allowing them to bypass signature verification.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:a0b2026075e946fc046a6be46170a902051230d147061868209d559abd71981b_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:bb4c7f2f2f1d61d8bfcbf5a991d5faf417fb43ae189c3a008b367a3c2567121e_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:eae5ef47a0c9a80a074dd1e03d60ed54b2d53fe77753ba26cdc62f8d6d44f1f1_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:4dbc2192d14ddc31d6ca95e637852b762e5637e8bcdeff88955ee94c2599f8cd_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:982c6ba6d54fdd28de2c8e272426a2b7543a0a4d07ecc52cf2e42210708a8c60_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:f720639c165ca0ab66ff5065b6239f665de1f9f9dac825ee216c2964cb67d69b_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f10ae0b327ecd7dc04d10e378d92ad8ed707c74af76570e51a92a4b9b7e2da23_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:08fb4410b8b418429c02957af6b1395159b27429bbd36983b5a42f5650de26a5_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:7bed37d976e23dc5866cfb97db4ba0da14e3bdfcb0619ffd00890ed2f0a87baa_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:c1a33f9ba0d8fb1b7bab9905e4e15d34d13a21b3bfea169a4b306147315148b7_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:c642d449979bc1f96c588a8763fe0e97a39d9a4ed5d093c8a114b46d79fc92d5_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:9222d6512b416186d1d5d0a051f3f873d5835c3942c368cbe79bbc24357ed0a5_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-bundle@sha256:d562451f2b3de78ff747137f3c12f146e89f378608eaeec522a694fd8056fa17_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:029c488d9e828cc1e630ac1ff78f93a84d910d04138c541300cde0006ca2412e_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0d1e82d1dd7c3bbcf73e6a04b6f853e50b99ef3557923fa9cbc44ff4bdaf4e95_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:e077bc427559e79bbbf67445a4790b7b0c75a86fc846278f25039df8139079c5_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4602"
},
{
"category": "external",
"summary": "RHBZ#2450206",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450206"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4602",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4602"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4602",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4602"
},
{
"category": "external",
"summary": "https://gist.github.com/Kr0emer/7ecd2be7d17419e4677315ef3758faf5",
"url": "https://gist.github.com/Kr0emer/7ecd2be7d17419e4677315ef3758faf5"
},
{
"category": "external",
"summary": "https://github.com/kjur/jsrsasign/commit/5ea1c32bb2aa894b4bd29849839afe4f98728195",
"url": "https://github.com/kjur/jsrsasign/commit/5ea1c32bb2aa894b4bd29849839afe4f98728195"
},
{
"category": "external",
"summary": "https://github.com/kjur/jsrsasign/pull/650",
"url": "https://github.com/kjur/jsrsasign/pull/650"
},
{
"category": "external",
"summary": "https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15371175",
"url": "https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15371175"
}
],
"release_date": "2026-03-23T05:00:10.567000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-07T17:36:52+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:a0b2026075e946fc046a6be46170a902051230d147061868209d559abd71981b_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:bb4c7f2f2f1d61d8bfcbf5a991d5faf417fb43ae189c3a008b367a3c2567121e_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:eae5ef47a0c9a80a074dd1e03d60ed54b2d53fe77753ba26cdc62f8d6d44f1f1_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:6912"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:4dbc2192d14ddc31d6ca95e637852b762e5637e8bcdeff88955ee94c2599f8cd_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:982c6ba6d54fdd28de2c8e272426a2b7543a0a4d07ecc52cf2e42210708a8c60_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:f720639c165ca0ab66ff5065b6239f665de1f9f9dac825ee216c2964cb67d69b_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f10ae0b327ecd7dc04d10e378d92ad8ed707c74af76570e51a92a4b9b7e2da23_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:08fb4410b8b418429c02957af6b1395159b27429bbd36983b5a42f5650de26a5_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:7bed37d976e23dc5866cfb97db4ba0da14e3bdfcb0619ffd00890ed2f0a87baa_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:c1a33f9ba0d8fb1b7bab9905e4e15d34d13a21b3bfea169a4b306147315148b7_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:c642d449979bc1f96c588a8763fe0e97a39d9a4ed5d093c8a114b46d79fc92d5_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:9222d6512b416186d1d5d0a051f3f873d5835c3942c368cbe79bbc24357ed0a5_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-bundle@sha256:d562451f2b3de78ff747137f3c12f146e89f378608eaeec522a694fd8056fa17_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:029c488d9e828cc1e630ac1ff78f93a84d910d04138c541300cde0006ca2412e_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0d1e82d1dd7c3bbcf73e6a04b6f853e50b99ef3557923fa9cbc44ff4bdaf4e95_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:e077bc427559e79bbbf67445a4790b7b0c75a86fc846278f25039df8139079c5_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:a0b2026075e946fc046a6be46170a902051230d147061868209d559abd71981b_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:bb4c7f2f2f1d61d8bfcbf5a991d5faf417fb43ae189c3a008b367a3c2567121e_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:eae5ef47a0c9a80a074dd1e03d60ed54b2d53fe77753ba26cdc62f8d6d44f1f1_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:4dbc2192d14ddc31d6ca95e637852b762e5637e8bcdeff88955ee94c2599f8cd_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:982c6ba6d54fdd28de2c8e272426a2b7543a0a4d07ecc52cf2e42210708a8c60_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:f720639c165ca0ab66ff5065b6239f665de1f9f9dac825ee216c2964cb67d69b_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f10ae0b327ecd7dc04d10e378d92ad8ed707c74af76570e51a92a4b9b7e2da23_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:08fb4410b8b418429c02957af6b1395159b27429bbd36983b5a42f5650de26a5_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:7bed37d976e23dc5866cfb97db4ba0da14e3bdfcb0619ffd00890ed2f0a87baa_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:c1a33f9ba0d8fb1b7bab9905e4e15d34d13a21b3bfea169a4b306147315148b7_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:c642d449979bc1f96c588a8763fe0e97a39d9a4ed5d093c8a114b46d79fc92d5_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:9222d6512b416186d1d5d0a051f3f873d5835c3942c368cbe79bbc24357ed0a5_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-bundle@sha256:d562451f2b3de78ff747137f3c12f146e89f378608eaeec522a694fd8056fa17_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:029c488d9e828cc1e630ac1ff78f93a84d910d04138c541300cde0006ca2412e_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0d1e82d1dd7c3bbcf73e6a04b6f853e50b99ef3557923fa9cbc44ff4bdaf4e95_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:e077bc427559e79bbbf67445a4790b7b0c75a86fc846278f25039df8139079c5_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:a0b2026075e946fc046a6be46170a902051230d147061868209d559abd71981b_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:bb4c7f2f2f1d61d8bfcbf5a991d5faf417fb43ae189c3a008b367a3c2567121e_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:eae5ef47a0c9a80a074dd1e03d60ed54b2d53fe77753ba26cdc62f8d6d44f1f1_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jsrsasign: jsrsasign: Signature verification bypass via negative exponent handling"
},
{
"cve": "CVE-2026-28498",
"cwe": {
"id": "CWE-325",
"name": "Missing Cryptographic Step"
},
"discovery_date": "2026-03-16T19:02:00.128339+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:4dbc2192d14ddc31d6ca95e637852b762e5637e8bcdeff88955ee94c2599f8cd_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:982c6ba6d54fdd28de2c8e272426a2b7543a0a4d07ecc52cf2e42210708a8c60_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:f720639c165ca0ab66ff5065b6239f665de1f9f9dac825ee216c2964cb67d69b_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f10ae0b327ecd7dc04d10e378d92ad8ed707c74af76570e51a92a4b9b7e2da23_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:08fb4410b8b418429c02957af6b1395159b27429bbd36983b5a42f5650de26a5_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:7bed37d976e23dc5866cfb97db4ba0da14e3bdfcb0619ffd00890ed2f0a87baa_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:c1a33f9ba0d8fb1b7bab9905e4e15d34d13a21b3bfea169a4b306147315148b7_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:c642d449979bc1f96c588a8763fe0e97a39d9a4ed5d093c8a114b46d79fc92d5_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:9222d6512b416186d1d5d0a051f3f873d5835c3942c368cbe79bbc24357ed0a5_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-bundle@sha256:d562451f2b3de78ff747137f3c12f146e89f378608eaeec522a694fd8056fa17_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:029c488d9e828cc1e630ac1ff78f93a84d910d04138c541300cde0006ca2412e_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0d1e82d1dd7c3bbcf73e6a04b6f853e50b99ef3557923fa9cbc44ff4bdaf4e95_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:e077bc427559e79bbbf67445a4790b7b0c75a86fc846278f25039df8139079c5_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2448182"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Authlib, a Python library used for building OAuth and OpenID Connect (OIDC) servers. This vulnerability allows a remote attacker to bypass critical integrity checks in OIDC ID Tokens. Specifically, the library\u0027s internal hash verification logic fails open when encountering an unsupported cryptographic algorithm, accepting a forged ID Token as valid. This can lead to an authentication bypass, granting unauthorized access to systems relying on Authlib for OIDC authentication.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "authlib: Authlib: Authentication bypass via forged OpenID Connect ID Tokens",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This IMPORTANT vulnerability in Authlib allows attackers to bypass OIDC ID Token integrity verification. The at_hash and c_hash validation fails open for unknown algorithms, accepting forged tokens as valid. Exploitation requires no authentication or user interaction. Impact is high to confidentiality and integrity. Red Hat products using Authlib for OIDC validation are affected. Fixed in version 1.6.9.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:a0b2026075e946fc046a6be46170a902051230d147061868209d559abd71981b_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:bb4c7f2f2f1d61d8bfcbf5a991d5faf417fb43ae189c3a008b367a3c2567121e_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:eae5ef47a0c9a80a074dd1e03d60ed54b2d53fe77753ba26cdc62f8d6d44f1f1_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:4dbc2192d14ddc31d6ca95e637852b762e5637e8bcdeff88955ee94c2599f8cd_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:982c6ba6d54fdd28de2c8e272426a2b7543a0a4d07ecc52cf2e42210708a8c60_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:f720639c165ca0ab66ff5065b6239f665de1f9f9dac825ee216c2964cb67d69b_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f10ae0b327ecd7dc04d10e378d92ad8ed707c74af76570e51a92a4b9b7e2da23_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:08fb4410b8b418429c02957af6b1395159b27429bbd36983b5a42f5650de26a5_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:7bed37d976e23dc5866cfb97db4ba0da14e3bdfcb0619ffd00890ed2f0a87baa_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:c1a33f9ba0d8fb1b7bab9905e4e15d34d13a21b3bfea169a4b306147315148b7_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:c642d449979bc1f96c588a8763fe0e97a39d9a4ed5d093c8a114b46d79fc92d5_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:9222d6512b416186d1d5d0a051f3f873d5835c3942c368cbe79bbc24357ed0a5_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-bundle@sha256:d562451f2b3de78ff747137f3c12f146e89f378608eaeec522a694fd8056fa17_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:029c488d9e828cc1e630ac1ff78f93a84d910d04138c541300cde0006ca2412e_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0d1e82d1dd7c3bbcf73e6a04b6f853e50b99ef3557923fa9cbc44ff4bdaf4e95_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:e077bc427559e79bbbf67445a4790b7b0c75a86fc846278f25039df8139079c5_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-28498"
},
{
"category": "external",
"summary": "RHBZ#2448182",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448182"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-28498",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28498"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-28498",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28498"
},
{
"category": "external",
"summary": "https://github.com/authlib/authlib/commit/b9bb2b25bf8b7e01512d847a95c1749646eaa72b",
"url": "https://github.com/authlib/authlib/commit/b9bb2b25bf8b7e01512d847a95c1749646eaa72b"
},
{
"category": "external",
"summary": "https://github.com/authlib/authlib/releases/tag/v1.6.9",
"url": "https://github.com/authlib/authlib/releases/tag/v1.6.9"
},
{
"category": "external",
"summary": "https://github.com/authlib/authlib/security/advisories/GHSA-m344-f55w-2m6j",
"url": "https://github.com/authlib/authlib/security/advisories/GHSA-m344-f55w-2m6j"
}
],
"release_date": "2026-03-16T18:03:28.821000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-07T17:36:52+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:a0b2026075e946fc046a6be46170a902051230d147061868209d559abd71981b_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:bb4c7f2f2f1d61d8bfcbf5a991d5faf417fb43ae189c3a008b367a3c2567121e_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:eae5ef47a0c9a80a074dd1e03d60ed54b2d53fe77753ba26cdc62f8d6d44f1f1_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:6912"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:4dbc2192d14ddc31d6ca95e637852b762e5637e8bcdeff88955ee94c2599f8cd_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:982c6ba6d54fdd28de2c8e272426a2b7543a0a4d07ecc52cf2e42210708a8c60_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:f720639c165ca0ab66ff5065b6239f665de1f9f9dac825ee216c2964cb67d69b_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f10ae0b327ecd7dc04d10e378d92ad8ed707c74af76570e51a92a4b9b7e2da23_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:08fb4410b8b418429c02957af6b1395159b27429bbd36983b5a42f5650de26a5_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:7bed37d976e23dc5866cfb97db4ba0da14e3bdfcb0619ffd00890ed2f0a87baa_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:c1a33f9ba0d8fb1b7bab9905e4e15d34d13a21b3bfea169a4b306147315148b7_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:c642d449979bc1f96c588a8763fe0e97a39d9a4ed5d093c8a114b46d79fc92d5_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:9222d6512b416186d1d5d0a051f3f873d5835c3942c368cbe79bbc24357ed0a5_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-bundle@sha256:d562451f2b3de78ff747137f3c12f146e89f378608eaeec522a694fd8056fa17_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:029c488d9e828cc1e630ac1ff78f93a84d910d04138c541300cde0006ca2412e_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0d1e82d1dd7c3bbcf73e6a04b6f853e50b99ef3557923fa9cbc44ff4bdaf4e95_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:e077bc427559e79bbbf67445a4790b7b0c75a86fc846278f25039df8139079c5_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:a0b2026075e946fc046a6be46170a902051230d147061868209d559abd71981b_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:bb4c7f2f2f1d61d8bfcbf5a991d5faf417fb43ae189c3a008b367a3c2567121e_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:eae5ef47a0c9a80a074dd1e03d60ed54b2d53fe77753ba26cdc62f8d6d44f1f1_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "authlib: Authlib: Authentication bypass via forged OpenID Connect ID Tokens"
},
{
"cve": "CVE-2026-30922",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
},
"discovery_date": "2026-03-18T04:02:45.401296+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:4dbc2192d14ddc31d6ca95e637852b762e5637e8bcdeff88955ee94c2599f8cd_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:982c6ba6d54fdd28de2c8e272426a2b7543a0a4d07ecc52cf2e42210708a8c60_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:f720639c165ca0ab66ff5065b6239f665de1f9f9dac825ee216c2964cb67d69b_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f10ae0b327ecd7dc04d10e378d92ad8ed707c74af76570e51a92a4b9b7e2da23_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:08fb4410b8b418429c02957af6b1395159b27429bbd36983b5a42f5650de26a5_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:7bed37d976e23dc5866cfb97db4ba0da14e3bdfcb0619ffd00890ed2f0a87baa_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:c1a33f9ba0d8fb1b7bab9905e4e15d34d13a21b3bfea169a4b306147315148b7_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:c642d449979bc1f96c588a8763fe0e97a39d9a4ed5d093c8a114b46d79fc92d5_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:9222d6512b416186d1d5d0a051f3f873d5835c3942c368cbe79bbc24357ed0a5_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-bundle@sha256:d562451f2b3de78ff747137f3c12f146e89f378608eaeec522a694fd8056fa17_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:029c488d9e828cc1e630ac1ff78f93a84d910d04138c541300cde0006ca2412e_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0d1e82d1dd7c3bbcf73e6a04b6f853e50b99ef3557923fa9cbc44ff4bdaf4e95_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:e077bc427559e79bbbf67445a4790b7b0c75a86fc846278f25039df8139079c5_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2448553"
}
],
"notes": [
{
"category": "description",
"text": "An unbounded recursion flaw has been discovered in the pypi pyasn1 library. This uncontrolled recursion occurs when decoding ASN.1 data with deeply nested structures. An attacker can supply a crafted payload containing nested SEQUENCE (0x30) or SET (0x31) tags with Indefinite Length (0x80) markers. This forces the decoder to recursively call itself until the Python interpreter crashes with a RecursionError or consumes all available memory (OOM), crashing the host application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:a0b2026075e946fc046a6be46170a902051230d147061868209d559abd71981b_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:bb4c7f2f2f1d61d8bfcbf5a991d5faf417fb43ae189c3a008b367a3c2567121e_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:eae5ef47a0c9a80a074dd1e03d60ed54b2d53fe77753ba26cdc62f8d6d44f1f1_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:4dbc2192d14ddc31d6ca95e637852b762e5637e8bcdeff88955ee94c2599f8cd_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:982c6ba6d54fdd28de2c8e272426a2b7543a0a4d07ecc52cf2e42210708a8c60_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:f720639c165ca0ab66ff5065b6239f665de1f9f9dac825ee216c2964cb67d69b_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f10ae0b327ecd7dc04d10e378d92ad8ed707c74af76570e51a92a4b9b7e2da23_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:08fb4410b8b418429c02957af6b1395159b27429bbd36983b5a42f5650de26a5_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:7bed37d976e23dc5866cfb97db4ba0da14e3bdfcb0619ffd00890ed2f0a87baa_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:c1a33f9ba0d8fb1b7bab9905e4e15d34d13a21b3bfea169a4b306147315148b7_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:c642d449979bc1f96c588a8763fe0e97a39d9a4ed5d093c8a114b46d79fc92d5_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:9222d6512b416186d1d5d0a051f3f873d5835c3942c368cbe79bbc24357ed0a5_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-bundle@sha256:d562451f2b3de78ff747137f3c12f146e89f378608eaeec522a694fd8056fa17_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:029c488d9e828cc1e630ac1ff78f93a84d910d04138c541300cde0006ca2412e_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0d1e82d1dd7c3bbcf73e6a04b6f853e50b99ef3557923fa9cbc44ff4bdaf4e95_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:e077bc427559e79bbbf67445a4790b7b0c75a86fc846278f25039df8139079c5_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-30922"
},
{
"category": "external",
"summary": "RHBZ#2448553",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448553"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-30922",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-30922"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-30922",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-30922"
},
{
"category": "external",
"summary": "https://github.com/pyasn1/pyasn1/commit/25ad481c19fdb006e20485ef3fc2e5b3eff30ef0",
"url": "https://github.com/pyasn1/pyasn1/commit/25ad481c19fdb006e20485ef3fc2e5b3eff30ef0"
},
{
"category": "external",
"summary": "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-jr27-m4p2-rc6r",
"url": "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-jr27-m4p2-rc6r"
}
],
"release_date": "2026-03-18T02:29:45.857000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-07T17:36:52+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:a0b2026075e946fc046a6be46170a902051230d147061868209d559abd71981b_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:bb4c7f2f2f1d61d8bfcbf5a991d5faf417fb43ae189c3a008b367a3c2567121e_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:eae5ef47a0c9a80a074dd1e03d60ed54b2d53fe77753ba26cdc62f8d6d44f1f1_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:6912"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:4dbc2192d14ddc31d6ca95e637852b762e5637e8bcdeff88955ee94c2599f8cd_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:982c6ba6d54fdd28de2c8e272426a2b7543a0a4d07ecc52cf2e42210708a8c60_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:f720639c165ca0ab66ff5065b6239f665de1f9f9dac825ee216c2964cb67d69b_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f10ae0b327ecd7dc04d10e378d92ad8ed707c74af76570e51a92a4b9b7e2da23_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:08fb4410b8b418429c02957af6b1395159b27429bbd36983b5a42f5650de26a5_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:7bed37d976e23dc5866cfb97db4ba0da14e3bdfcb0619ffd00890ed2f0a87baa_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:c1a33f9ba0d8fb1b7bab9905e4e15d34d13a21b3bfea169a4b306147315148b7_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:c642d449979bc1f96c588a8763fe0e97a39d9a4ed5d093c8a114b46d79fc92d5_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:9222d6512b416186d1d5d0a051f3f873d5835c3942c368cbe79bbc24357ed0a5_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-bundle@sha256:d562451f2b3de78ff747137f3c12f146e89f378608eaeec522a694fd8056fa17_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:029c488d9e828cc1e630ac1ff78f93a84d910d04138c541300cde0006ca2412e_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0d1e82d1dd7c3bbcf73e6a04b6f853e50b99ef3557923fa9cbc44ff4bdaf4e95_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:e077bc427559e79bbbf67445a4790b7b0c75a86fc846278f25039df8139079c5_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:a0b2026075e946fc046a6be46170a902051230d147061868209d559abd71981b_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:bb4c7f2f2f1d61d8bfcbf5a991d5faf417fb43ae189c3a008b367a3c2567121e_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:eae5ef47a0c9a80a074dd1e03d60ed54b2d53fe77753ba26cdc62f8d6d44f1f1_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:4dbc2192d14ddc31d6ca95e637852b762e5637e8bcdeff88955ee94c2599f8cd_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:982c6ba6d54fdd28de2c8e272426a2b7543a0a4d07ecc52cf2e42210708a8c60_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:f720639c165ca0ab66ff5065b6239f665de1f9f9dac825ee216c2964cb67d69b_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f10ae0b327ecd7dc04d10e378d92ad8ed707c74af76570e51a92a4b9b7e2da23_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:08fb4410b8b418429c02957af6b1395159b27429bbd36983b5a42f5650de26a5_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:7bed37d976e23dc5866cfb97db4ba0da14e3bdfcb0619ffd00890ed2f0a87baa_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:c1a33f9ba0d8fb1b7bab9905e4e15d34d13a21b3bfea169a4b306147315148b7_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:c642d449979bc1f96c588a8763fe0e97a39d9a4ed5d093c8a114b46d79fc92d5_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:9222d6512b416186d1d5d0a051f3f873d5835c3942c368cbe79bbc24357ed0a5_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-bundle@sha256:d562451f2b3de78ff747137f3c12f146e89f378608eaeec522a694fd8056fa17_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:029c488d9e828cc1e630ac1ff78f93a84d910d04138c541300cde0006ca2412e_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0d1e82d1dd7c3bbcf73e6a04b6f853e50b99ef3557923fa9cbc44ff4bdaf4e95_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:e077bc427559e79bbbf67445a4790b7b0c75a86fc846278f25039df8139079c5_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:a0b2026075e946fc046a6be46170a902051230d147061868209d559abd71981b_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:bb4c7f2f2f1d61d8bfcbf5a991d5faf417fb43ae189c3a008b367a3c2567121e_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:eae5ef47a0c9a80a074dd1e03d60ed54b2d53fe77753ba26cdc62f8d6d44f1f1_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion"
},
{
"cve": "CVE-2026-32597",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-03-12T22:01:29.967713+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:4dbc2192d14ddc31d6ca95e637852b762e5637e8bcdeff88955ee94c2599f8cd_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:982c6ba6d54fdd28de2c8e272426a2b7543a0a4d07ecc52cf2e42210708a8c60_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:f720639c165ca0ab66ff5065b6239f665de1f9f9dac825ee216c2964cb67d69b_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f10ae0b327ecd7dc04d10e378d92ad8ed707c74af76570e51a92a4b9b7e2da23_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:08fb4410b8b418429c02957af6b1395159b27429bbd36983b5a42f5650de26a5_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:7bed37d976e23dc5866cfb97db4ba0da14e3bdfcb0619ffd00890ed2f0a87baa_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:c1a33f9ba0d8fb1b7bab9905e4e15d34d13a21b3bfea169a4b306147315148b7_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:c642d449979bc1f96c588a8763fe0e97a39d9a4ed5d093c8a114b46d79fc92d5_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:9222d6512b416186d1d5d0a051f3f873d5835c3942c368cbe79bbc24357ed0a5_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-bundle@sha256:d562451f2b3de78ff747137f3c12f146e89f378608eaeec522a694fd8056fa17_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:029c488d9e828cc1e630ac1ff78f93a84d910d04138c541300cde0006ca2412e_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0d1e82d1dd7c3bbcf73e6a04b6f853e50b99ef3557923fa9cbc44ff4bdaf4e95_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:e077bc427559e79bbbf67445a4790b7b0c75a86fc846278f25039df8139079c5_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2447194"
}
],
"notes": [
{
"category": "description",
"text": "A missing verification step has been discovered in PyJWT. PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 \u00a74.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 \u00a74.1.11 MUST violation)",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:a0b2026075e946fc046a6be46170a902051230d147061868209d559abd71981b_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:bb4c7f2f2f1d61d8bfcbf5a991d5faf417fb43ae189c3a008b367a3c2567121e_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:eae5ef47a0c9a80a074dd1e03d60ed54b2d53fe77753ba26cdc62f8d6d44f1f1_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:4dbc2192d14ddc31d6ca95e637852b762e5637e8bcdeff88955ee94c2599f8cd_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:982c6ba6d54fdd28de2c8e272426a2b7543a0a4d07ecc52cf2e42210708a8c60_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:f720639c165ca0ab66ff5065b6239f665de1f9f9dac825ee216c2964cb67d69b_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f10ae0b327ecd7dc04d10e378d92ad8ed707c74af76570e51a92a4b9b7e2da23_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:08fb4410b8b418429c02957af6b1395159b27429bbd36983b5a42f5650de26a5_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:7bed37d976e23dc5866cfb97db4ba0da14e3bdfcb0619ffd00890ed2f0a87baa_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:c1a33f9ba0d8fb1b7bab9905e4e15d34d13a21b3bfea169a4b306147315148b7_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:c642d449979bc1f96c588a8763fe0e97a39d9a4ed5d093c8a114b46d79fc92d5_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:9222d6512b416186d1d5d0a051f3f873d5835c3942c368cbe79bbc24357ed0a5_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-bundle@sha256:d562451f2b3de78ff747137f3c12f146e89f378608eaeec522a694fd8056fa17_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:029c488d9e828cc1e630ac1ff78f93a84d910d04138c541300cde0006ca2412e_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0d1e82d1dd7c3bbcf73e6a04b6f853e50b99ef3557923fa9cbc44ff4bdaf4e95_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:e077bc427559e79bbbf67445a4790b7b0c75a86fc846278f25039df8139079c5_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32597"
},
{
"category": "external",
"summary": "RHBZ#2447194",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447194"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32597",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32597"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32597",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32597"
},
{
"category": "external",
"summary": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-752w-5fwx-jx9f",
"url": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-752w-5fwx-jx9f"
}
],
"release_date": "2026-03-12T21:41:50.427000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-07T17:36:52+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:a0b2026075e946fc046a6be46170a902051230d147061868209d559abd71981b_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:bb4c7f2f2f1d61d8bfcbf5a991d5faf417fb43ae189c3a008b367a3c2567121e_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:eae5ef47a0c9a80a074dd1e03d60ed54b2d53fe77753ba26cdc62f8d6d44f1f1_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:6912"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:4dbc2192d14ddc31d6ca95e637852b762e5637e8bcdeff88955ee94c2599f8cd_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:982c6ba6d54fdd28de2c8e272426a2b7543a0a4d07ecc52cf2e42210708a8c60_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:f720639c165ca0ab66ff5065b6239f665de1f9f9dac825ee216c2964cb67d69b_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f10ae0b327ecd7dc04d10e378d92ad8ed707c74af76570e51a92a4b9b7e2da23_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:08fb4410b8b418429c02957af6b1395159b27429bbd36983b5a42f5650de26a5_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:7bed37d976e23dc5866cfb97db4ba0da14e3bdfcb0619ffd00890ed2f0a87baa_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:c1a33f9ba0d8fb1b7bab9905e4e15d34d13a21b3bfea169a4b306147315148b7_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:c642d449979bc1f96c588a8763fe0e97a39d9a4ed5d093c8a114b46d79fc92d5_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:9222d6512b416186d1d5d0a051f3f873d5835c3942c368cbe79bbc24357ed0a5_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-bundle@sha256:d562451f2b3de78ff747137f3c12f146e89f378608eaeec522a694fd8056fa17_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:029c488d9e828cc1e630ac1ff78f93a84d910d04138c541300cde0006ca2412e_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0d1e82d1dd7c3bbcf73e6a04b6f853e50b99ef3557923fa9cbc44ff4bdaf4e95_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:e077bc427559e79bbbf67445a4790b7b0c75a86fc846278f25039df8139079c5_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:a0b2026075e946fc046a6be46170a902051230d147061868209d559abd71981b_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:bb4c7f2f2f1d61d8bfcbf5a991d5faf417fb43ae189c3a008b367a3c2567121e_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:eae5ef47a0c9a80a074dd1e03d60ed54b2d53fe77753ba26cdc62f8d6d44f1f1_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:4dbc2192d14ddc31d6ca95e637852b762e5637e8bcdeff88955ee94c2599f8cd_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:982c6ba6d54fdd28de2c8e272426a2b7543a0a4d07ecc52cf2e42210708a8c60_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/clair-rhel8@sha256:f720639c165ca0ab66ff5065b6239f665de1f9f9dac825ee216c2964cb67d69b_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f10ae0b327ecd7dc04d10e378d92ad8ed707c74af76570e51a92a4b9b7e2da23_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:08fb4410b8b418429c02957af6b1395159b27429bbd36983b5a42f5650de26a5_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:7bed37d976e23dc5866cfb97db4ba0da14e3bdfcb0619ffd00890ed2f0a87baa_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:c1a33f9ba0d8fb1b7bab9905e4e15d34d13a21b3bfea169a4b306147315148b7_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-builder-rhel8@sha256:c642d449979bc1f96c588a8763fe0e97a39d9a4ed5d093c8a114b46d79fc92d5_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:9222d6512b416186d1d5d0a051f3f873d5835c3942c368cbe79bbc24357ed0a5_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-bundle@sha256:d562451f2b3de78ff747137f3c12f146e89f378608eaeec522a694fd8056fa17_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:029c488d9e828cc1e630ac1ff78f93a84d910d04138c541300cde0006ca2412e_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:0d1e82d1dd7c3bbcf73e6a04b6f853e50b99ef3557923fa9cbc44ff4bdaf4e95_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-operator-rhel8@sha256:e077bc427559e79bbbf67445a4790b7b0c75a86fc846278f25039df8139079c5_amd64",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:a0b2026075e946fc046a6be46170a902051230d147061868209d559abd71981b_ppc64le",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:bb4c7f2f2f1d61d8bfcbf5a991d5faf417fb43ae189c3a008b367a3c2567121e_s390x",
"Red Hat Quay 3.1:registry.redhat.io/quay/quay-rhel8@sha256:eae5ef47a0c9a80a074dd1e03d60ed54b2d53fe77753ba26cdc62f8d6d44f1f1_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 \u00a74.1.11 MUST violation)"
}
]
}
RHSA-2026:6926
Vulnerability from csaf_redhat - Published: 2026-04-07 21:36 - Updated: 2026-08-10 06:53Summary
Red Hat Security Advisory: Red Hat Quay 3.9.20
Severity
Important
Notes
Topic: Red Hat Quay 3.9.20 is now available with bug fixes.
Details: Quay 3.9.20
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in jsrsasign. An attacker can exploit an incomplete comparison vulnerability in the getRandomBigIntegerZeroToMax and getRandomBigIntegerMinToMax functions. By manipulating incorrect comparison checks, an attacker can bias the Digital Signature Algorithm (DSA) nonces during signature generation. This allows the attacker to recover the private key, leading to a critical security compromise.
9.1 (Critical)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in jsrsasign. An attacker can exploit improper verification of cryptographic signatures by supplying malicious domain parameters during the Digital Signature Algorithm (DSA) validation process. This allows the attacker to forge DSA signatures or X.509 certificates, which would then be accepted as legitimate, potentially leading to unauthorized access or data manipulation.
8.2 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in jsrsasign. An attacker can exploit a missing cryptographic step in the Digital Signature Algorithm (DSA) signing process, specifically within the KJUR.crypto.DSA.signWithMessageHash function. By manipulating the signature generation to force specific values, the library emits an invalid signature without retrying. This vulnerability allows an attacker to recover the private key used for signing.
8.7 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in jsrsasign. A remote attacker can exploit an incorrect conversion between numeric types by providing a negative exponent to the `modPow` function. This vulnerability can force the computation of incorrect modular inverses, which ultimately allows an attacker to bypass signature verification.
7.5 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Immutable.js, a library for persistent immutable data structures. This vulnerability, known as Prototype Pollution, allows an attacker with low privileges to inject unwanted properties into core JavaScript object prototypes without user interaction. By manipulating specific APIs such as mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject(), a remote attacker could potentially execute arbitrary code or cause a denial of service (DoS).
8.8 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64 | — |
Vendor Fix
fix
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le | — |
Threats
Impact
Important
A flaw was found in SVGO, an SVG (Scalable Vector Graphics) Optimizer. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by submitting a specially crafted XML file. The application's failure to properly guard against XML entity expansion or recursion can lead to the Node.js process consuming excessive memory and crashing.
7.5 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le | — |
Workaround
|
Threats
Impact
Important
An unbounded recursion flaw has been discovered in the pypi pyasn1 library. This uncontrolled recursion occurs when decoding ASN.1 data with deeply nested structures. An attacker can supply a crafted payload containing nested SEQUENCE (0x30) or SET (0x31) tags with Indefinite Length (0x80) markers. This forces the decoder to recursively call itself until the Python interpreter crashes with a RecursionError or consumes all available memory (OOM), crashing the host application.
7.5 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le | — |
Workaround
|
Threats
Impact
Important
A missing verification step has been discovered in PyJWT. PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC.
7.5 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le | — |
Workaround
|
Threats
Impact
Important
References
67 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat Quay 3.9.20 is now available with bug fixes.",
"title": "Topic"
},
{
"category": "general",
"text": "Quay 3.9.20",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:6926",
"url": "https://access.redhat.com/errata/RHSA-2026:6926"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-29063",
"url": "https://access.redhat.com/security/cve/CVE-2026-29063"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-29074",
"url": "https://access.redhat.com/security/cve/CVE-2026-29074"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-30922",
"url": "https://access.redhat.com/security/cve/CVE-2026-30922"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32597",
"url": "https://access.redhat.com/security/cve/CVE-2026-32597"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-4599",
"url": "https://access.redhat.com/security/cve/CVE-2026-4599"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-4600",
"url": "https://access.redhat.com/security/cve/CVE-2026-4600"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-4601",
"url": "https://access.redhat.com/security/cve/CVE-2026-4601"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-4602",
"url": "https://access.redhat.com/security/cve/CVE-2026-4602"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_6926.json"
}
],
"title": "Red Hat Security Advisory: Red Hat Quay 3.9.20",
"tracking": {
"current_release_date": "2026-08-10T06:53:36+00:00",
"generator": {
"date": "2026-08-10T06:53:36+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.12"
}
},
"id": "RHSA-2026:6926",
"initial_release_date": "2026-04-07T21:36:48+00:00",
"revision_history": [
{
"date": "2026-04-07T21:36:48+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-08-08T04:36:23+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-10T06:53:36+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Quay 3.9",
"product": {
"name": "Red Hat Quay 3.9",
"product_id": "Red Hat Quay 3.9",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:quay:3.9::el8"
}
}
}
],
"category": "product_family",
"name": "Red Hat Quay"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"product_id": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-bundle@sha256%3A28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e?arch=amd64\u0026repository_url=registry.redhat.io/quay\u0026tag=1774886457"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"product_id": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-rhel8@sha256%3A713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943?arch=amd64\u0026repository_url=registry.redhat.io/quay\u0026tag=1774885670"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"product_id": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-bundle@sha256%3Af2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807?arch=amd64\u0026repository_url=registry.redhat.io/quay\u0026tag=1774887042"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"product_id": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-rhel8@sha256%3A8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2?arch=amd64\u0026repository_url=registry.redhat.io/quay\u0026tag=1774885680"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"product_id": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-qemu-rhcos-rhel8@sha256%3A74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9?arch=amd64\u0026repository_url=registry.redhat.io/quay\u0026tag=1775183053"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"product_id": "registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-rhel8@sha256%3A81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0?arch=amd64\u0026repository_url=registry.redhat.io/quay\u0026tag=1774885717"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"product": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"product_id": "registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"product_identification_helper": {
"purl": "pkg:oci/clair-rhel8@sha256%3A1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34?arch=amd64\u0026repository_url=registry.redhat.io/quay\u0026tag=1774885682"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"product_id": "registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-bundle@sha256%3A6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a?arch=amd64\u0026repository_url=registry.redhat.io/quay\u0026tag=1775184102"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"product_id": "registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-rhel8@sha256%3A87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0?arch=amd64\u0026repository_url=registry.redhat.io/quay\u0026tag=1774885725"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64",
"product_id": "registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-rhel8@sha256%3Aa18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed?arch=amd64\u0026repository_url=registry.redhat.io/quay\u0026tag=1775169218"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"product": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"product_id": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-rhel8@sha256%3Ac3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d?arch=ppc64le\u0026repository_url=registry.redhat.io/quay\u0026tag=1774885670"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"product": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"product_id": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-rhel8@sha256%3Abfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882?arch=ppc64le\u0026repository_url=registry.redhat.io/quay\u0026tag=1774885680"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"product": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"product_id": "registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-rhel8@sha256%3A6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036?arch=ppc64le\u0026repository_url=registry.redhat.io/quay\u0026tag=1774885717"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"product": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"product_id": "registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/clair-rhel8@sha256%3A0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72?arch=ppc64le\u0026repository_url=registry.redhat.io/quay\u0026tag=1774885682"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le",
"product": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le",
"product_id": "registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-rhel8@sha256%3Af845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f?arch=ppc64le\u0026repository_url=registry.redhat.io/quay\u0026tag=1774885725"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"product": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"product_id": "registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-rhel8@sha256%3A08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea?arch=ppc64le\u0026repository_url=registry.redhat.io/quay\u0026tag=1775169218"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"product": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"product_id": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-rhel8@sha256%3A49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e?arch=s390x\u0026repository_url=registry.redhat.io/quay\u0026tag=1774885670"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"product": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"product_id": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-rhel8@sha256%3A8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d?arch=s390x\u0026repository_url=registry.redhat.io/quay\u0026tag=1774885680"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"product": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"product_id": "registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-rhel8@sha256%3A61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26?arch=s390x\u0026repository_url=registry.redhat.io/quay\u0026tag=1774885717"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"product": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"product_id": "registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"product_identification_helper": {
"purl": "pkg:oci/clair-rhel8@sha256%3Ace200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce?arch=s390x\u0026repository_url=registry.redhat.io/quay\u0026tag=1774885682"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"product": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"product_id": "registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-rhel8@sha256%3Aef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a?arch=s390x\u0026repository_url=registry.redhat.io/quay\u0026tag=1774885725"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"product": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"product_id": "registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-rhel8@sha256%3A3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f?arch=s390x\u0026repository_url=registry.redhat.io/quay\u0026tag=1775169218"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le as a component of Red Hat Quay 3.9",
"product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le"
},
"product_reference": "registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64 as a component of Red Hat Quay 3.9",
"product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64"
},
"product_reference": "registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"relates_to_product_reference": "Red Hat Quay 3.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x as a component of Red Hat Quay 3.9",
"product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x"
},
"product_reference": "registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"relates_to_product_reference": "Red Hat Quay 3.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64 as a component of Red Hat Quay 3.9",
"product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"relates_to_product_reference": "Red Hat Quay 3.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x as a component of Red Hat Quay 3.9",
"product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x"
},
"product_reference": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"relates_to_product_reference": "Red Hat Quay 3.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64 as a component of Red Hat Quay 3.9",
"product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"relates_to_product_reference": "Red Hat Quay 3.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le as a component of Red Hat Quay 3.9",
"product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le"
},
"product_reference": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64 as a component of Red Hat Quay 3.9",
"product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"relates_to_product_reference": "Red Hat Quay 3.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x as a component of Red Hat Quay 3.9",
"product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x"
},
"product_reference": "registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"relates_to_product_reference": "Red Hat Quay 3.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le as a component of Red Hat Quay 3.9",
"product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le"
},
"product_reference": "registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64 as a component of Red Hat Quay 3.9",
"product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"relates_to_product_reference": "Red Hat Quay 3.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64 as a component of Red Hat Quay 3.9",
"product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"relates_to_product_reference": "Red Hat Quay 3.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x as a component of Red Hat Quay 3.9",
"product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x"
},
"product_reference": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"relates_to_product_reference": "Red Hat Quay 3.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64 as a component of Red Hat Quay 3.9",
"product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"relates_to_product_reference": "Red Hat Quay 3.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le as a component of Red Hat Quay 3.9",
"product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le"
},
"product_reference": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64 as a component of Red Hat Quay 3.9",
"product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"relates_to_product_reference": "Red Hat Quay 3.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64 as a component of Red Hat Quay 3.9",
"product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"relates_to_product_reference": "Red Hat Quay 3.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x as a component of Red Hat Quay 3.9",
"product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x"
},
"product_reference": "registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"relates_to_product_reference": "Red Hat Quay 3.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le as a component of Red Hat Quay 3.9",
"product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le"
},
"product_reference": "registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le as a component of Red Hat Quay 3.9",
"product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le"
},
"product_reference": "registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x as a component of Red Hat Quay 3.9",
"product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x"
},
"product_reference": "registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"relates_to_product_reference": "Red Hat Quay 3.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64 as a component of Red Hat Quay 3.9",
"product_id": "Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64",
"relates_to_product_reference": "Red Hat Quay 3.9"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-4599",
"cwe": {
"id": "CWE-338",
"name": "Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)"
},
"discovery_date": "2026-03-23T06:01:34.008562+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2450207"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jsrsasign. An attacker can exploit an incomplete comparison vulnerability in the getRandomBigIntegerZeroToMax and getRandomBigIntegerMinToMax functions. By manipulating incorrect comparison checks, an attacker can bias the Digital Signature Algorithm (DSA) nonces during signature generation. This allows the attacker to recover the private key, leading to a critical security compromise.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jsrsasign: jsrsasign: Private key recovery via incomplete comparison checks biasing DSA nonces",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4599"
},
{
"category": "external",
"summary": "RHBZ#2450207",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450207"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4599",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4599"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4599",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4599"
},
{
"category": "external",
"summary": "https://gist.github.com/Kr0emer/081681818b51605c91945126d74b4f20",
"url": "https://gist.github.com/Kr0emer/081681818b51605c91945126d74b4f20"
},
{
"category": "external",
"summary": "https://github.com/kjur/jsrsasign/commit/ee4b013478366cb16cea9a4bdfb218b6077f83b1",
"url": "https://github.com/kjur/jsrsasign/commit/ee4b013478366cb16cea9a4bdfb218b6077f83b1"
},
{
"category": "external",
"summary": "https://github.com/kjur/jsrsasign/pull/647",
"url": "https://github.com/kjur/jsrsasign/pull/647"
},
{
"category": "external",
"summary": "https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370939",
"url": "https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370939"
}
],
"release_date": "2026-03-23T05:00:12.522000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-07T21:36:48+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:6926"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jsrsasign: jsrsasign: Private key recovery via incomplete comparison checks biasing DSA nonces"
},
{
"cve": "CVE-2026-4600",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-03-23T06:01:39.334925+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2450208"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jsrsasign. An attacker can exploit improper verification of cryptographic signatures by supplying malicious domain parameters during the Digital Signature Algorithm (DSA) validation process. This allows the attacker to forge DSA signatures or X.509 certificates, which would then be accepted as legitimate, potentially leading to unauthorized access or data manipulation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jsrsasign: jsrsasign: Cryptographic signature forgery via malicious DSA domain parameters",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "IMPORTANT. The flaw in jsrsasign allows an attacker to forge Digital Signature Algorithm (DSA) signatures or X.509 certificates by providing malicious domain parameters during validation. This could lead to unauthorized access or data manipulation in affected Red Hat products such as Migration Toolkit for Virtualization and Red Hat Quay, where jsrsasign is utilized for cryptographic signature verification.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4600"
},
{
"category": "external",
"summary": "RHBZ#2450208",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450208"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4600",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4600"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4600",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4600"
},
{
"category": "external",
"summary": "https://gist.github.com/Kr0emer/bf15ddc097176e951659a24a8e9002a7",
"url": "https://gist.github.com/Kr0emer/bf15ddc097176e951659a24a8e9002a7"
},
{
"category": "external",
"summary": "https://github.com/kjur/jsrsasign/commit/37b4c06b145c7bfd6bc2a6df5d0a12c56b15ef60",
"url": "https://github.com/kjur/jsrsasign/commit/37b4c06b145c7bfd6bc2a6df5d0a12c56b15ef60"
},
{
"category": "external",
"summary": "https://github.com/kjur/jsrsasign/pull/646",
"url": "https://github.com/kjur/jsrsasign/pull/646"
},
{
"category": "external",
"summary": "https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370940",
"url": "https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370940"
}
],
"release_date": "2026-03-23T05:00:08.475000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-07T21:36:48+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:6926"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jsrsasign: jsrsasign: Cryptographic signature forgery via malicious DSA domain parameters"
},
{
"cve": "CVE-2026-4601",
"cwe": {
"id": "CWE-325",
"name": "Missing Cryptographic Step"
},
"discovery_date": "2026-03-23T06:01:44.014846+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2450209"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jsrsasign. An attacker can exploit a missing cryptographic step in the Digital Signature Algorithm (DSA) signing process, specifically within the KJUR.crypto.DSA.signWithMessageHash function. By manipulating the signature generation to force specific values, the library emits an invalid signature without retrying. This vulnerability allows an attacker to recover the private key used for signing.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jsrsasign: jsrsasign: Private Key Recovery via Missing Cryptographic Step in DSA Signing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "IMPORTANT: A flaw in the jsrsasign library allows for private key recovery due to a missing cryptographic step in the Digital Signature Algorithm (DSA) signing process. An attacker can manipulate signature generation within the KJUR.crypto.DSA.signWithMessageHash function to force specific values, enabling the recovery of the private key. This impacts Red Hat products utilizing jsrsasign, such as Migration Toolkit for Virtualization and Red Hat Quay.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4601"
},
{
"category": "external",
"summary": "RHBZ#2450209",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450209"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4601",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4601"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4601",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4601"
},
{
"category": "external",
"summary": "https://gist.github.com/Kr0emer/93789fe6efe5519db9692d4ad1dad586",
"url": "https://gist.github.com/Kr0emer/93789fe6efe5519db9692d4ad1dad586"
},
{
"category": "external",
"summary": "https://github.com/kjur/jsrsasign/commit/0710e392ec35de697ce11e4219c988ba2b5fe0eb",
"url": "https://github.com/kjur/jsrsasign/commit/0710e392ec35de697ce11e4219c988ba2b5fe0eb"
},
{
"category": "external",
"summary": "https://github.com/kjur/jsrsasign/pull/645",
"url": "https://github.com/kjur/jsrsasign/pull/645"
},
{
"category": "external",
"summary": "https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370941",
"url": "https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15370941"
}
],
"release_date": "2026-03-23T05:00:13.312000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-07T21:36:48+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:6926"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jsrsasign: jsrsasign: Private Key Recovery via Missing Cryptographic Step in DSA Signing"
},
{
"cve": "CVE-2026-4602",
"cwe": {
"id": "CWE-681",
"name": "Incorrect Conversion between Numeric Types"
},
"discovery_date": "2026-03-23T06:01:28.729668+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2450206"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jsrsasign. A remote attacker can exploit an incorrect conversion between numeric types by providing a negative exponent to the `modPow` function. This vulnerability can force the computation of incorrect modular inverses, which ultimately allows an attacker to bypass signature verification.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jsrsasign: jsrsasign: Signature verification bypass via negative exponent handling",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an IMPORTANT flaw. The `jsrsasign` library, as used in Red Hat products such as Migration Toolkit for Virtualization and Red Hat Quay, is vulnerable to a signature verification bypass. A remote attacker could provide a specially crafted negative exponent to the `modPow` function, leading to incorrect modular inverse computations and allowing them to bypass signature verification.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4602"
},
{
"category": "external",
"summary": "RHBZ#2450206",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450206"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4602",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4602"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4602",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4602"
},
{
"category": "external",
"summary": "https://gist.github.com/Kr0emer/7ecd2be7d17419e4677315ef3758faf5",
"url": "https://gist.github.com/Kr0emer/7ecd2be7d17419e4677315ef3758faf5"
},
{
"category": "external",
"summary": "https://github.com/kjur/jsrsasign/commit/5ea1c32bb2aa894b4bd29849839afe4f98728195",
"url": "https://github.com/kjur/jsrsasign/commit/5ea1c32bb2aa894b4bd29849839afe4f98728195"
},
{
"category": "external",
"summary": "https://github.com/kjur/jsrsasign/pull/650",
"url": "https://github.com/kjur/jsrsasign/pull/650"
},
{
"category": "external",
"summary": "https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15371175",
"url": "https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-15371175"
}
],
"release_date": "2026-03-23T05:00:10.567000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-07T21:36:48+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:6926"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jsrsasign: jsrsasign: Signature verification bypass via negative exponent handling"
},
{
"cve": "CVE-2026-29063",
"cwe": {
"id": "CWE-915",
"name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
},
"discovery_date": "2026-03-06T19:00:57.982727+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445291"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Immutable.js, a library for persistent immutable data structures. This vulnerability, known as Prototype Pollution, allows an attacker with low privileges to inject unwanted properties into core JavaScript object prototypes without user interaction. By manipulating specific APIs such as mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject(), a remote attacker could potentially execute arbitrary code or cause a denial of service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "immutable-js: Immutable.js: Arbitrary code execution via Prototype Pollution",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Exploitation of this vulnerability requires that an attacker is able to provide arbitrary data to clients of this library in a way that calls the affected functions with data the attacker controls. In most deployments, the ability to provide data in this fashion requires that an attacker has some degree of privileges to access the affected applications.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-29063"
},
{
"category": "external",
"summary": "RHBZ#2445291",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445291"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-29063",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-29063"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-29063",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29063"
},
{
"category": "external",
"summary": "https://github.com/immutable-js/immutable-js/releases/tag/v3.8.3",
"url": "https://github.com/immutable-js/immutable-js/releases/tag/v3.8.3"
},
{
"category": "external",
"summary": "https://github.com/immutable-js/immutable-js/releases/tag/v4.3.8",
"url": "https://github.com/immutable-js/immutable-js/releases/tag/v4.3.8"
},
{
"category": "external",
"summary": "https://github.com/immutable-js/immutable-js/releases/tag/v5.1.5",
"url": "https://github.com/immutable-js/immutable-js/releases/tag/v5.1.5"
},
{
"category": "external",
"summary": "https://github.com/immutable-js/immutable-js/security/advisories/GHSA-wf6x-7x77-mvgw",
"url": "https://github.com/immutable-js/immutable-js/security/advisories/GHSA-wf6x-7x77-mvgw"
}
],
"release_date": "2026-03-06T18:25:22.438000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-07T21:36:48+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:6926"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "immutable-js: Immutable.js: Arbitrary code execution via Prototype Pollution"
},
{
"cve": "CVE-2026-29074",
"cwe": {
"id": "CWE-776",
"name": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)"
},
"discovery_date": "2026-03-06T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445132"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in SVGO, an SVG (Scalable Vector Graphics) Optimizer. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by submitting a specially crafted XML file. The application\u0027s failure to properly guard against XML entity expansion or recursion can lead to the Node.js process consuming excessive memory and crashing.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "svgo: SVGO: Denial of Service via XML entity expansion",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-29074"
},
{
"category": "external",
"summary": "RHBZ#2445132",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445132"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-29074",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-29074"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-29074",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29074"
},
{
"category": "external",
"summary": "https://github.com/svg/svgo/security/advisories/GHSA-xpqw-6gx7-v673",
"url": "https://github.com/svg/svgo/security/advisories/GHSA-xpqw-6gx7-v673"
}
],
"release_date": "2026-03-06T07:23:05.716000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-07T21:36:48+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:6926"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "svgo: SVGO: Denial of Service via XML entity expansion"
},
{
"cve": "CVE-2026-30922",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
},
"discovery_date": "2026-03-18T04:02:45.401296+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2448553"
}
],
"notes": [
{
"category": "description",
"text": "An unbounded recursion flaw has been discovered in the pypi pyasn1 library. This uncontrolled recursion occurs when decoding ASN.1 data with deeply nested structures. An attacker can supply a crafted payload containing nested SEQUENCE (0x30) or SET (0x31) tags with Indefinite Length (0x80) markers. This forces the decoder to recursively call itself until the Python interpreter crashes with a RecursionError or consumes all available memory (OOM), crashing the host application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-30922"
},
{
"category": "external",
"summary": "RHBZ#2448553",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448553"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-30922",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-30922"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-30922",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-30922"
},
{
"category": "external",
"summary": "https://github.com/pyasn1/pyasn1/commit/25ad481c19fdb006e20485ef3fc2e5b3eff30ef0",
"url": "https://github.com/pyasn1/pyasn1/commit/25ad481c19fdb006e20485ef3fc2e5b3eff30ef0"
},
{
"category": "external",
"summary": "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-jr27-m4p2-rc6r",
"url": "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-jr27-m4p2-rc6r"
}
],
"release_date": "2026-03-18T02:29:45.857000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-07T21:36:48+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:6926"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion"
},
{
"cve": "CVE-2026-32597",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-03-12T22:01:29.967713+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2447194"
}
],
"notes": [
{
"category": "description",
"text": "A missing verification step has been discovered in PyJWT. PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 \u00a74.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 \u00a74.1.11 MUST violation)",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
],
"known_not_affected": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32597"
},
{
"category": "external",
"summary": "RHBZ#2447194",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447194"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32597",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32597"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32597",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32597"
},
{
"category": "external",
"summary": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-752w-5fwx-jx9f",
"url": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-752w-5fwx-jx9f"
}
],
"release_date": "2026-03-12T21:41:50.427000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-07T21:36:48+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:6926"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:0b50975dbe6ebd9f44296fd0f45ae0215dd07e981c511e0981f40421a4733c72_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:1d7bb186c76156359836714503ab7fecba45e29ff17d8ae7d757fcc37da15f34_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/clair-rhel8@sha256:ce200b9bb13ab522f92a6ed2dfc95f1662b1b7826e4c1ceb1027ef8e546c57ce_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:f2cd5b22de1888426f34c2ca60c7bfcf988720eb09fde54cbca446515e55d807_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8c71c78de43d3f0e93120b4daf42f617ce8fbc77029ff58b5a8f076076eab69d_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:8f15d337eba9e3469b2ac2319db147aaece3b4d5fb04d45083b75f5391e015b2_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:bfb47116542d4d23b664ad165aa6995106eb671a2a653056cc0f661c3a521882_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:74aca61c87c9fb817c58aad4f6108a5199e87a448640f2635dafc375ef4319d9_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:61cd166bb3a22d0cea774c2af0b2236a552be0e3523fe79a19d3da9965d4fd26_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:6ad93a010e132baa54cf92b0dcf2d4e58c3a16abd907672e35ec6bcba4c44036_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-builder-rhel8@sha256:81d9d54e878d5ba7d299bbd68bece124827454161f72e4682ef75a32b749b3d0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:28e36f1dc571c91e7746972337c9aa4e2bb2b5f94a9386588396b7871dde478e_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:49b501ce5d01f3a0692114e4db3fa2f581857aa398014e3b61dfb56eee91d58e_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:713258ea45b0180149adaac08ae2531be7f6829a6b4635b0f0820faa48b85943_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:c3e7c9f4c6f25477b7eeaf2dec796fdffc41a6048296b313acda8199a5426f1d_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-bundle@sha256:6b22a78edf7695230706c14b50d7a4d4cb0d6a6c4e34cc9f66ad2da8b8f44f1a_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:87670b0a08bda15047ce8d0e5ce71cbe21fe7029bd5c2c73fc00ba339f97cdf0_amd64",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:ef8aede1d912ed60006f05a713b43f5f7133dfc16c67ed5503bc08f9fe34020a_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-operator-rhel8@sha256:f845bc884db119eca8662f5039fd06db5b7efb14bab08d0b3bd524810149308f_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:08299d2ffb70a6b3f892ca732f97961a10a72cb4d4c123f10e81633f5c1c69ea_ppc64le",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:3f297a001a34b3e16d07d0a8d0b93ab2b09d4bc0e99f5e402a779138f67cea9f_s390x",
"Red Hat Quay 3.9:registry.redhat.io/quay/quay-rhel8@sha256:a18b9479f4b10eaf07463b0da6660e106f2a924f92d576790187a6676930f5ed_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 \u00a74.1.11 MUST violation)"
}
]
}
RHSA-2026:8437
Vulnerability from csaf_redhat - Published: 2026-04-16 10:43 - Updated: 2026-08-08 16:35Summary
Red Hat Security Advisory: RHTAS 1.4 - GA Release of Model Transparency
Severity
Important
Notes
Topic: The GA release of the RHTAS Model Transparency CLI image.
For more details please visit the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4
Details: The RHTAS Model Transparency CLI image can be used to sign and verify AI/ML workloads
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in pyOpenSSL. The set_cookie_generate_callback callback function can be used to generate DTLS cookies. When the callback returns a cookie string or byte sequence longer than 256 bytes, a buffer overflow can be triggered due to a missing bounds checking before copying the data to a fixed-size buffer provided by the underlying OpenSSL library.
8.1 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:58f6c2216f1b745ff0af4195dc72395eeab531bf8561b507ea64730f38ecc24d_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:66b12e8e6822f23ad63f43c660d815d8007da46aa5ac3b5cceebf727b147f755_arm64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
An unbounded recursion flaw has been discovered in the pypi pyasn1 library. This uncontrolled recursion occurs when decoding ASN.1 data with deeply nested structures. An attacker can supply a crafted payload containing nested SEQUENCE (0x30) or SET (0x31) tags with Indefinite Length (0x80) markers. This forces the decoder to recursively call itself until the Python interpreter crashes with a RecursionError or consumes all available memory (OOM), crashing the host application.
7.5 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:58f6c2216f1b745ff0af4195dc72395eeab531bf8561b507ea64730f38ecc24d_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:66b12e8e6822f23ad63f43c660d815d8007da46aa5ac3b5cceebf727b147f755_arm64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A missing verification step has been discovered in PyJWT. PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC.
7.5 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:58f6c2216f1b745ff0af4195dc72395eeab531bf8561b507ea64730f38ecc24d_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:66b12e8e6822f23ad63f43c660d815d8007da46aa5ac3b5cceebf727b147f755_arm64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
References
26 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "The GA release of the RHTAS Model Transparency CLI image.\nFor more details please visit the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4",
"title": "Topic"
},
{
"category": "general",
"text": "The RHTAS Model Transparency CLI image can be used to sign and verify AI/ML workloads",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:8437",
"url": "https://access.redhat.com/errata/RHSA-2026:8437"
},
{
"category": "external",
"summary": "https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4",
"url": "https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4"
},
{
"category": "external",
"summary": "https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4/html-single/release_notes/index",
"url": "https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4/html-single/release_notes/index"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-27459",
"url": "https://access.redhat.com/security/cve/CVE-2026-27459"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-30922",
"url": "https://access.redhat.com/security/cve/CVE-2026-30922"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32597",
"url": "https://access.redhat.com/security/cve/CVE-2026-32597"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_8437.json"
}
],
"title": "Red Hat Security Advisory: RHTAS 1.4 - GA Release of Model Transparency",
"tracking": {
"current_release_date": "2026-08-08T16:35:49+00:00",
"generator": {
"date": "2026-08-08T16:35:49+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.12"
}
},
"id": "RHSA-2026:8437",
"initial_release_date": "2026-04-16T10:43:56+00:00",
"revision_history": [
{
"date": "2026-04-16T10:43:56+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-08-08T04:36:23+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-08T16:35:49+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Trusted Artifact Signer 1.4",
"product": {
"name": "Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:trusted_artifact_signer:1.4::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat Trusted Artifact Signer"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/rhtas/model-transparency-rhel9@sha256:58f6c2216f1b745ff0af4195dc72395eeab531bf8561b507ea64730f38ecc24d_amd64",
"product": {
"name": "registry.redhat.io/rhtas/model-transparency-rhel9@sha256:58f6c2216f1b745ff0af4195dc72395eeab531bf8561b507ea64730f38ecc24d_amd64",
"product_id": "registry.redhat.io/rhtas/model-transparency-rhel9@sha256:58f6c2216f1b745ff0af4195dc72395eeab531bf8561b507ea64730f38ecc24d_amd64",
"product_identification_helper": {
"purl": "pkg:oci/model-transparency-rhel9@sha256%3A58f6c2216f1b745ff0af4195dc72395eeab531bf8561b507ea64730f38ecc24d?arch=amd64\u0026repository_url=registry.redhat.io/rhtas\u0026tag=1775815407"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/rhtas/model-transparency-rhel9@sha256:66b12e8e6822f23ad63f43c660d815d8007da46aa5ac3b5cceebf727b147f755_arm64",
"product": {
"name": "registry.redhat.io/rhtas/model-transparency-rhel9@sha256:66b12e8e6822f23ad63f43c660d815d8007da46aa5ac3b5cceebf727b147f755_arm64",
"product_id": "registry.redhat.io/rhtas/model-transparency-rhel9@sha256:66b12e8e6822f23ad63f43c660d815d8007da46aa5ac3b5cceebf727b147f755_arm64",
"product_identification_helper": {
"purl": "pkg:oci/model-transparency-rhel9@sha256%3A66b12e8e6822f23ad63f43c660d815d8007da46aa5ac3b5cceebf727b147f755?arch=arm64\u0026repository_url=registry.redhat.io/rhtas\u0026tag=1775815407"
}
}
}
],
"category": "architecture",
"name": "arm64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhtas/model-transparency-rhel9@sha256:58f6c2216f1b745ff0af4195dc72395eeab531bf8561b507ea64730f38ecc24d_amd64 as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:58f6c2216f1b745ff0af4195dc72395eeab531bf8561b507ea64730f38ecc24d_amd64"
},
"product_reference": "registry.redhat.io/rhtas/model-transparency-rhel9@sha256:58f6c2216f1b745ff0af4195dc72395eeab531bf8561b507ea64730f38ecc24d_amd64",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhtas/model-transparency-rhel9@sha256:66b12e8e6822f23ad63f43c660d815d8007da46aa5ac3b5cceebf727b147f755_arm64 as a component of Red Hat Trusted Artifact Signer 1.4",
"product_id": "Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:66b12e8e6822f23ad63f43c660d815d8007da46aa5ac3b5cceebf727b147f755_arm64"
},
"product_reference": "registry.redhat.io/rhtas/model-transparency-rhel9@sha256:66b12e8e6822f23ad63f43c660d815d8007da46aa5ac3b5cceebf727b147f755_arm64",
"relates_to_product_reference": "Red Hat Trusted Artifact Signer 1.4"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-27459",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2026-03-18T00:01:41.404915+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2448503"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in pyOpenSSL. The set_cookie_generate_callback callback function can be used to generate DTLS cookies. When the callback returns a cookie string or byte sequence longer than 256 bytes, a buffer overflow can be triggered due to a missing bounds checking before copying the data to a fixed-size buffer provided by the underlying OpenSSL library.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "pyOpenSSL: DTLS cookie callback buffer overflow",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw is only exploitable when an application using the pyOpenSSL library provides a custom callback to the set_cookie_generate_callback function. For the buffer overflow to occur, the callback function must return a cookie string or byte sequence longer than 256 bytes, limiting the exposure of this issue. Due to these reasons, this vulnerability has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:58f6c2216f1b745ff0af4195dc72395eeab531bf8561b507ea64730f38ecc24d_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:66b12e8e6822f23ad63f43c660d815d8007da46aa5ac3b5cceebf727b147f755_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27459"
},
{
"category": "external",
"summary": "RHBZ#2448503",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448503"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27459",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27459"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27459",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27459"
},
{
"category": "external",
"summary": "https://github.com/pyca/pyopenssl/blob/358cbf29c4e364c59930e53a270116249581eaa3/CHANGELOG.rst",
"url": "https://github.com/pyca/pyopenssl/blob/358cbf29c4e364c59930e53a270116249581eaa3/CHANGELOG.rst"
},
{
"category": "external",
"summary": "https://github.com/pyca/pyopenssl/commit/57f09bb4bb051d3bc2a1abd36e9525313d5cd408",
"url": "https://github.com/pyca/pyopenssl/commit/57f09bb4bb051d3bc2a1abd36e9525313d5cd408"
},
{
"category": "external",
"summary": "https://github.com/pyca/pyopenssl/security/advisories/GHSA-5pwr-322w-8jr4",
"url": "https://github.com/pyca/pyopenssl/security/advisories/GHSA-5pwr-322w-8jr4"
}
],
"release_date": "2026-03-17T23:34:28.483000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T10:43:56+00:00",
"details": "The Model Transparency CLI Image is a containerized command-line tool for signing and verifying AI/ML workloads against a private Red Hat Trusted Artifact Signer (RHTAS) instance. It lets teams create signatures and attestations for model artifacts and validate them at build or deploy time using enterprise trust material (e.g., Fulcio/Rekor).\n\nFor details on using the Model Transparency CLI image, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4/html-single/release_notes/index",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:58f6c2216f1b745ff0af4195dc72395eeab531bf8561b507ea64730f38ecc24d_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:66b12e8e6822f23ad63f43c660d815d8007da46aa5ac3b5cceebf727b147f755_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8437"
},
{
"category": "workaround",
"details": "To mitigate this flaw, ensure the callback provided to the set_cookie_generate_callback function strictly limits the returned cookie string or byte sequence to under 256 bytes.",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:58f6c2216f1b745ff0af4195dc72395eeab531bf8561b507ea64730f38ecc24d_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:66b12e8e6822f23ad63f43c660d815d8007da46aa5ac3b5cceebf727b147f755_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:58f6c2216f1b745ff0af4195dc72395eeab531bf8561b507ea64730f38ecc24d_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:66b12e8e6822f23ad63f43c660d815d8007da46aa5ac3b5cceebf727b147f755_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "pyOpenSSL: DTLS cookie callback buffer overflow"
},
{
"cve": "CVE-2026-30922",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
},
"discovery_date": "2026-03-18T04:02:45.401296+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2448553"
}
],
"notes": [
{
"category": "description",
"text": "An unbounded recursion flaw has been discovered in the pypi pyasn1 library. This uncontrolled recursion occurs when decoding ASN.1 data with deeply nested structures. An attacker can supply a crafted payload containing nested SEQUENCE (0x30) or SET (0x31) tags with Indefinite Length (0x80) markers. This forces the decoder to recursively call itself until the Python interpreter crashes with a RecursionError or consumes all available memory (OOM), crashing the host application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:58f6c2216f1b745ff0af4195dc72395eeab531bf8561b507ea64730f38ecc24d_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:66b12e8e6822f23ad63f43c660d815d8007da46aa5ac3b5cceebf727b147f755_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-30922"
},
{
"category": "external",
"summary": "RHBZ#2448553",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448553"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-30922",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-30922"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-30922",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-30922"
},
{
"category": "external",
"summary": "https://github.com/pyasn1/pyasn1/commit/25ad481c19fdb006e20485ef3fc2e5b3eff30ef0",
"url": "https://github.com/pyasn1/pyasn1/commit/25ad481c19fdb006e20485ef3fc2e5b3eff30ef0"
},
{
"category": "external",
"summary": "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-jr27-m4p2-rc6r",
"url": "https://github.com/pyasn1/pyasn1/security/advisories/GHSA-jr27-m4p2-rc6r"
}
],
"release_date": "2026-03-18T02:29:45.857000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T10:43:56+00:00",
"details": "The Model Transparency CLI Image is a containerized command-line tool for signing and verifying AI/ML workloads against a private Red Hat Trusted Artifact Signer (RHTAS) instance. It lets teams create signatures and attestations for model artifacts and validate them at build or deploy time using enterprise trust material (e.g., Fulcio/Rekor).\n\nFor details on using the Model Transparency CLI image, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4/html-single/release_notes/index",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:58f6c2216f1b745ff0af4195dc72395eeab531bf8561b507ea64730f38ecc24d_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:66b12e8e6822f23ad63f43c660d815d8007da46aa5ac3b5cceebf727b147f755_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8437"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:58f6c2216f1b745ff0af4195dc72395eeab531bf8561b507ea64730f38ecc24d_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:66b12e8e6822f23ad63f43c660d815d8007da46aa5ac3b5cceebf727b147f755_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:58f6c2216f1b745ff0af4195dc72395eeab531bf8561b507ea64730f38ecc24d_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:66b12e8e6822f23ad63f43c660d815d8007da46aa5ac3b5cceebf727b147f755_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion"
},
{
"cve": "CVE-2026-32597",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-03-12T22:01:29.967713+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2447194"
}
],
"notes": [
{
"category": "description",
"text": "A missing verification step has been discovered in PyJWT. PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 \u00a74.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 \u00a74.1.11 MUST violation)",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:58f6c2216f1b745ff0af4195dc72395eeab531bf8561b507ea64730f38ecc24d_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:66b12e8e6822f23ad63f43c660d815d8007da46aa5ac3b5cceebf727b147f755_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32597"
},
{
"category": "external",
"summary": "RHBZ#2447194",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447194"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32597",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32597"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32597",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32597"
},
{
"category": "external",
"summary": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-752w-5fwx-jx9f",
"url": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-752w-5fwx-jx9f"
}
],
"release_date": "2026-03-12T21:41:50.427000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T10:43:56+00:00",
"details": "The Model Transparency CLI Image is a containerized command-line tool for signing and verifying AI/ML workloads against a private Red Hat Trusted Artifact Signer (RHTAS) instance. It lets teams create signatures and attestations for model artifacts and validate them at build or deploy time using enterprise trust material (e.g., Fulcio/Rekor).\n\nFor details on using the Model Transparency CLI image, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4\n\nYou can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4/html-single/release_notes/index",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:58f6c2216f1b745ff0af4195dc72395eeab531bf8561b507ea64730f38ecc24d_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:66b12e8e6822f23ad63f43c660d815d8007da46aa5ac3b5cceebf727b147f755_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8437"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:58f6c2216f1b745ff0af4195dc72395eeab531bf8561b507ea64730f38ecc24d_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:66b12e8e6822f23ad63f43c660d815d8007da46aa5ac3b5cceebf727b147f755_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:58f6c2216f1b745ff0af4195dc72395eeab531bf8561b507ea64730f38ecc24d_amd64",
"Red Hat Trusted Artifact Signer 1.4:registry.redhat.io/rhtas/model-transparency-rhel9@sha256:66b12e8e6822f23ad63f43c660d815d8007da46aa5ac3b5cceebf727b147f755_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 \u00a74.1.11 MUST violation)"
}
]
}
RHSA-2026:8746
Vulnerability from csaf_redhat - Published: 2026-04-17 11:10 - Updated: 2026-08-08 16:34Summary
Red Hat Security Advisory: Red Hat AI Inference Server 3.3.1 (CUDA)
Severity
Important
Notes
Topic: Red Hat AI Inference Server 3.3.1 (CUDA) is now available.
Details: Red Hat® AI Inference Server
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in libxslt package. Processing web content may disclose sensitive information. This issue was addressed with improved memory handling.
6.5 (Medium)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a_amd64 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
A segment fault (SEGV) flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFReadRGBATileExt() API. This flaw allows a remote attacker to cause a heap-buffer overflow, leading to a denial of service.
7.5 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a_amd64 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
A flaw was found in the http.client module in the Python standard library. When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This issue allows a malicious server to cause the client to read large amounts of data into memory, potentially causing memory allocations errors, swapping, out-of-memory conditions or even system freezes.
6.8 (Medium)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in GnuTLS. This vulnerability allows a denial of service (DoS) by excessive CPU (Central Processing Unit) and memory consumption via specially crafted malicious certificates containing a large number of name constraints and subject alternative names (SANs).
5.3 (Medium)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a_amd64 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
A flaw was found in the imaplib module in the Python standard library. The imaplib module does not reject control characters, such as newlines, in user-controlled input passed to IMAP commands. This issue allows an attacker to inject additional commands to be executed in the IMAP server.
7.1 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in the poplib module in the Python standard library. The poplib module does not reject control characters, such as newlines, in user-controlled input passed to POP3 commands. This issue allows an attacker to inject additional commands to be executed in the POP3 server.
7.1 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in protobuf. A remote attacker can exploit this denial-of-service (DoS) vulnerability by supplying deeply nested `google.protobuf.Any` messages to the `google.protobuf.json_format.ParseDict()` function. This bypasses the intended recursion depth limit, leading to the exhaustion of Python’s recursion stack and causing a `RecursionError`, which results in a denial of service.
7.5 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in the email module in the Python standard library. When serializing an email message, the BytesGenerator class fails to properly quote newline characters for email headers. This issue is exploitable when the LiteralHeader class is used as it does not respect email folding rules, allowing an attacker to inject email headers and potentially modify message recipients or the email body, and spoof sender information.
7.1 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Heap buffer overflow in libvpx.
7.5 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically within the archive_read_data() processing path. When a specially crafted RAR5 archive is processed, the decompression routine may enter a state where internal logic prevents forward progress. This condition results in an infinite loop that continuously consumes CPU resources. Because the archive passes checksum validation and appears structurally valid, affected applications cannot detect the issue before processing. This can allow attackers to cause persistent denial-of-service conditions in services that automatically process archives.
7.5 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Python. The `webbrowser.open()` API, used to launch web browsers, does not properly sanitize input. This allows a remote attacker to craft a malicious URL containing leading dashes. When such a URL is opened, certain web browsers may interpret these dashes as command-line options, which could lead to unexpected behavior, information disclosure, or potentially arbitrary code execution, impacting the integrity of the system.
7.1 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in libpng, a reference library for processing PNG (Portable Network Graphics) image files. A local attacker could exploit a heap buffer over-read vulnerability in the `png_image_finish_read` function by tricking a user into processing a specially crafted interlaced 16-bit PNG file with an 8-bit output format and non-minimal row stride. This could lead to a denial of service (DoS) and potentially information disclosure.
6.1 (Medium)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in libpng, a reference library for PNG (Portable Network Graphics) raster image files. An integer truncation vulnerability exists in the png_write_image_16bit and png_write_image_8bit simplified write API functions. A local attacker could exploit this flaw by providing a negative row stride (for bottom-up image layouts) or a stride exceeding 65535 bytes, leading to a heap buffer over-read. This can result in information disclosure or a denial of service (DoS) to the system.
6.6 (Medium)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A heap based buffer overflow flaw has been discovered in LibPNG. Prior to version 1.6.55, an out-of-bounds read vulnerability exists in the png_set_quantize() API function. When the function is called with no histogram and the number of colors in the palette is more than twice the maximum supported by the user's display, certain palettes will cause the function to enter into an infinite loop that reads past the end of an internal heap-allocated buffer. The images that trigger this vulnerability are valid per the PNG specification.
7.0 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in vLLM, an inference and serving engine for large language models (LLMs). Two model implementation files hardcode `trust_remote_code=True` when loading sub-components. This bypasses the user's explicit `--trust-remote-code=False` security opt-out, allowing a remote attacker to achieve remote code execution through malicious model repositories.
8.8 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A missing verification step has been discovered in PyJWT. PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC.
7.5 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
References
130 references
Acknowledgments
Elhanan Haenel
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat AI Inference Server 3.3.1 (CUDA) is now available.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat\u00ae AI Inference Server",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:8746",
"url": "https://access.redhat.com/errata/RHSA-2026:8746"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2023-40403",
"url": "https://access.redhat.com/security/cve/CVE-2023-40403"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2023-52356",
"url": "https://access.redhat.com/security/cve/CVE-2023-52356"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-13836",
"url": "https://access.redhat.com/security/cve/CVE-2025-13836"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-14831",
"url": "https://access.redhat.com/security/cve/CVE-2025-14831"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-15366",
"url": "https://access.redhat.com/security/cve/CVE-2025-15366"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-15367",
"url": "https://access.redhat.com/security/cve/CVE-2025-15367"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-0994",
"url": "https://access.redhat.com/security/cve/CVE-2026-0994"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-1299",
"url": "https://access.redhat.com/security/cve/CVE-2026-1299"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-22695",
"url": "https://access.redhat.com/security/cve/CVE-2026-22695"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-22801",
"url": "https://access.redhat.com/security/cve/CVE-2026-22801"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-2447",
"url": "https://access.redhat.com/security/cve/CVE-2026-2447"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-25646",
"url": "https://access.redhat.com/security/cve/CVE-2026-25646"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-27893",
"url": "https://access.redhat.com/security/cve/CVE-2026-27893"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32597",
"url": "https://access.redhat.com/security/cve/CVE-2026-32597"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-4111",
"url": "https://access.redhat.com/security/cve/CVE-2026-4111"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-4519",
"url": "https://access.redhat.com/security/cve/CVE-2026-4519"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://www.redhat.com/en/products/ai/inference-server",
"url": "https://www.redhat.com/en/products/ai/inference-server"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_8746.json"
}
],
"title": "Red Hat Security Advisory: Red Hat AI Inference Server 3.3.1 (CUDA)",
"tracking": {
"current_release_date": "2026-08-08T16:34:16+00:00",
"generator": {
"date": "2026-08-08T16:34:16+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.12"
}
},
"id": "RHSA-2026:8746",
"initial_release_date": "2026-04-17T11:10:51+00:00",
"revision_history": [
{
"date": "2026-04-17T11:10:51+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-08-08T04:36:23+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-08T16:34:16+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat AI Inference Server 3.3",
"product": {
"name": "Red Hat AI Inference Server 3.3",
"product_id": "Red Hat AI Inference Server 3.3",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:ai_inference_server:3.3::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat AI Inference Server"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a_amd64",
"product": {
"name": "registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a_amd64",
"product_id": "registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a_amd64",
"product_identification_helper": {
"purl": "pkg:oci/vllm-cuda-rhel9@sha256%3A575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a?arch=amd64\u0026repository_url=registry.redhat.io/rhaiis\u0026tag=1775680192"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc_arm64",
"product": {
"name": "registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc_arm64",
"product_id": "registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc_arm64",
"product_identification_helper": {
"purl": "pkg:oci/vllm-cuda-rhel9@sha256%3A0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc?arch=arm64\u0026repository_url=registry.redhat.io/rhaiis\u0026tag=1775680192"
}
}
}
],
"category": "architecture",
"name": "arm64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc_arm64 as a component of Red Hat AI Inference Server 3.3",
"product_id": "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc_arm64"
},
"product_reference": "registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc_arm64",
"relates_to_product_reference": "Red Hat AI Inference Server 3.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a_amd64 as a component of Red Hat AI Inference Server 3.3",
"product_id": "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a_amd64"
},
"product_reference": "registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a_amd64",
"relates_to_product_reference": "Red Hat AI Inference Server 3.3"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2023-40403",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2025-03-04T12:01:50.826520+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2349766"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libxslt package. Processing web content may disclose sensitive information. This issue was addressed with improved memory handling.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxslt: Processing web content may disclose sensitive information",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This CVE is a duplicate of CVE-2022-4909.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2023-40403"
},
{
"category": "external",
"summary": "RHBZ#2349766",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2349766"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2023-40403",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-40403"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-40403",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40403"
},
{
"category": "external",
"summary": "http://seclists.org/fulldisclosure/2023/Oct/10",
"url": "http://seclists.org/fulldisclosure/2023/Oct/10"
},
{
"category": "external",
"summary": "http://seclists.org/fulldisclosure/2023/Oct/3",
"url": "http://seclists.org/fulldisclosure/2023/Oct/3"
},
{
"category": "external",
"summary": "http://seclists.org/fulldisclosure/2023/Oct/4",
"url": "http://seclists.org/fulldisclosure/2023/Oct/4"
},
{
"category": "external",
"summary": "http://seclists.org/fulldisclosure/2023/Oct/5",
"url": "http://seclists.org/fulldisclosure/2023/Oct/5"
},
{
"category": "external",
"summary": "http://seclists.org/fulldisclosure/2023/Oct/6",
"url": "http://seclists.org/fulldisclosure/2023/Oct/6"
},
{
"category": "external",
"summary": "http://seclists.org/fulldisclosure/2023/Oct/8",
"url": "http://seclists.org/fulldisclosure/2023/Oct/8"
},
{
"category": "external",
"summary": "http://seclists.org/fulldisclosure/2023/Oct/9",
"url": "http://seclists.org/fulldisclosure/2023/Oct/9"
},
{
"category": "external",
"summary": "https://bugs.chromium.org/p/chromium/issues/detail?id=1356211",
"url": "https://bugs.chromium.org/p/chromium/issues/detail?id=1356211"
},
{
"category": "external",
"summary": "https://bugzilla.gnome.org/show_bug.cgi?id=751621",
"url": "https://bugzilla.gnome.org/show_bug.cgi?id=751621"
},
{
"category": "external",
"summary": "https://gitlab.gnome.org/GNOME/libxslt/-/issues/94",
"url": "https://gitlab.gnome.org/GNOME/libxslt/-/issues/94"
},
{
"category": "external",
"summary": "https://support.apple.com/en-us/HT213927",
"url": "https://support.apple.com/en-us/HT213927"
}
],
"release_date": "2023-09-26T20:14:54.697000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-17T11:10:51+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:8746",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8746"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libxslt: Processing web content may disclose sensitive information"
},
{
"cve": "CVE-2023-52356",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2023-11-24T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2251344"
}
],
"notes": [
{
"category": "description",
"text": "A segment fault (SEGV) flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFReadRGBATileExt() API. This flaw allows a remote attacker to cause a heap-buffer overflow, leading to a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libtiff: Segment fault in libtiff in TIFFReadRGBATileExt() leading to denial of service",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The flaw allows an attacker to potentially cause a denial of service attack by crashing a program, but the impact is minimal.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2023-52356"
},
{
"category": "external",
"summary": "RHBZ#2251344",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2251344"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2023-52356",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-52356"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-52356",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-52356"
},
{
"category": "external",
"summary": "https://gitlab.com/libtiff/libtiff/-/issues/622",
"url": "https://gitlab.com/libtiff/libtiff/-/issues/622"
},
{
"category": "external",
"summary": "https://gitlab.com/libtiff/libtiff/-/merge_requests/546",
"url": "https://gitlab.com/libtiff/libtiff/-/merge_requests/546"
}
],
"release_date": "2023-11-03T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-17T11:10:51+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:8746",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8746"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libtiff: Segment fault in libtiff in TIFFReadRGBATileExt() leading to denial of service"
},
{
"cve": "CVE-2025-13836",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2025-12-01T19:01:03.091899+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2418078"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the http.client module in the Python standard library. When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This issue allows a malicious server to cause the client to read large amounts of data into memory, potentially causing memory allocations errors, swapping, out-of-memory conditions or even system freezes.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "cpython: Excessive read buffering DoS in http.client",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue can only be exploited by Python applications using the http.client.HTTPResponse.read function without the amount parameter, which specifies the read size in bytes. Note that Python libraries may use this function internally and make applications vulnerable. Additionally, vulnerable Python applications must connect to a malicious or compromised server that replies with a very large or crafted Content-Length header to trigger this issue, limiting the exposure of this vulnerability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-13836"
},
{
"category": "external",
"summary": "RHBZ#2418078",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418078"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-13836",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-13836"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-13836",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13836"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/issues/119451",
"url": "https://github.com/python/cpython/issues/119451"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/pull/119454",
"url": "https://github.com/python/cpython/pull/119454"
}
],
"release_date": "2025-12-01T18:02:38.483000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-17T11:10:51+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:8746",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8746"
},
{
"category": "workaround",
"details": "Since this vulnerability is triggered when no read amount is specified and the client defaults to using the potentially malicious Content-Length header, developers can mitigate this issue in their code by always imposing an explicit, safe limit on data reads.\n\nApplications using the http.client.HTTPResponse.read function directly can ensure that read operations specify a byte limit:\n\n~~~\n...\nmax_safe_read = 10 * 1024 * 1024\ndata = response.read(max_safe_read)\n...\n~~~",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "cpython: Excessive read buffering DoS in http.client"
},
{
"cve": "CVE-2025-14831",
"cwe": {
"id": "CWE-407",
"name": "Inefficient Algorithmic Complexity"
},
"discovery_date": "2025-12-17T14:48:30.222000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2423177"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in GnuTLS. This vulnerability allows a denial of service (DoS) by excessive CPU (Central Processing Unit) and memory consumption via specially crafted malicious certificates containing a large number of name constraints and subject alternative names (SANs).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "gnutls: GnuTLS: Denial of Service via excessive resource consumption during certificate verification",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Moderate for Red Hat. GnuTLS is susceptible to a denial of service attack due to excessive CPU and memory consumption. This occurs when processing specially crafted malicious certificates containing a large number of name constraints and subject alternative names (SANs) during certificate verification.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-14831"
},
{
"category": "external",
"summary": "RHBZ#2423177",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2423177"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-14831",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-14831"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-14831",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14831"
},
{
"category": "external",
"summary": "https://gitlab.com/gnutls/gnutls/-/issues/1773",
"url": "https://gitlab.com/gnutls/gnutls/-/issues/1773"
}
],
"release_date": "2026-02-09T14:26:34.939000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-17T11:10:51+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:8746",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8746"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "gnutls: GnuTLS: Denial of Service via excessive resource consumption during certificate verification"
},
{
"cve": "CVE-2025-15366",
"cwe": {
"id": "CWE-77",
"name": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)"
},
"discovery_date": "2026-01-20T22:01:33.257688+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2431368"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the imaplib module in the Python standard library. The imaplib module does not reject control characters, such as newlines, in user-controlled input passed to IMAP commands. This issue allows an attacker to inject additional commands to be executed in the IMAP server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "cpython: IMAP command injection in user-controlled commands",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to have the privileges required to send malicious input to an application that sends IMAP commands to a server. Additionally, this flaw can allow attackers to manipulate the state of the mailbox (e.g., delete emails, move folders, flag messages) and to potentially read metadata or specific email content, but it does not allow arbitrary code execution or OS command injection. Due to these reasons, this issue has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-15366"
},
{
"category": "external",
"summary": "RHBZ#2431368",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431368"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-15366",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-15366"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-15366",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15366"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/issues/143921",
"url": "https://github.com/python/cpython/issues/143921"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/pull/143922",
"url": "https://github.com/python/cpython/pull/143922"
},
{
"category": "external",
"summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/DD7C7JZJYTBXMDOWKCEIEBJLBRU64OMR/",
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/DD7C7JZJYTBXMDOWKCEIEBJLBRU64OMR/"
}
],
"release_date": "2026-01-20T21:40:24.938000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-17T11:10:51+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:8746",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8746"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, ensure that no data passed to the imaplib module contains newline or carriage return characters.",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "cpython: IMAP command injection in user-controlled commands"
},
{
"cve": "CVE-2025-15367",
"cwe": {
"id": "CWE-77",
"name": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)"
},
"discovery_date": "2026-01-20T22:02:09.399038+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2431373"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the poplib module in the Python standard library. The poplib module does not reject control characters, such as newlines, in user-controlled input passed to POP3 commands. This issue allows an attacker to inject additional commands to be executed in the POP3 server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "cpython: POP3 command injection in user-controlled commands",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to have the privileges required to send malicious input to an application that sends POP3 commands to a server. Additionally, this flaw can allow attackers to manipulate the state of the mailbox (e.g., delete emails) and to potentially read metadata or specific email content, but it does not allow arbitrary code execution or OS command injection. Due to these reasons, this issue has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-15367"
},
{
"category": "external",
"summary": "RHBZ#2431373",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431373"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-15367",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-15367"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-15367",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15367"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/issues/143923",
"url": "https://github.com/python/cpython/issues/143923"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/pull/143924",
"url": "https://github.com/python/cpython/pull/143924"
},
{
"category": "external",
"summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/CBFBOWVGGUJFSGITQCCBZS4GEYYZ7ZNE/",
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/CBFBOWVGGUJFSGITQCCBZS4GEYYZ7ZNE/"
}
],
"release_date": "2026-01-20T21:47:09.885000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-17T11:10:51+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:8746",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8746"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, ensure that no data passed to the poplib module contains newline or carriage return characters.",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "cpython: POP3 command injection in user-controlled commands"
},
{
"cve": "CVE-2026-0994",
"cwe": {
"id": "CWE-674",
"name": "Uncontrolled Recursion"
},
"discovery_date": "2026-01-23T16:02:59.235878+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2432398"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in protobuf. A remote attacker can exploit this denial-of-service (DoS) vulnerability by supplying deeply nested `google.protobuf.Any` messages to the `google.protobuf.json_format.ParseDict()` function. This bypasses the intended recursion depth limit, leading to the exhaustion of Python\u2019s recursion stack and causing a `RecursionError`, which results in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python: protobuf: Protobuf: Denial of Service due to recursion depth bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Important for Red Hat products. The flaw in `protobuf` allows a remote attacker to trigger a denial-of-service by providing specially crafted, deeply nested `google.protobuf.Any` messages to the `google.protobuf.json_format.ParseDict()` function. This bypasses the intended recursion depth limit, leading to resource exhaustion and application crashes.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-0994"
},
{
"category": "external",
"summary": "RHBZ#2432398",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2432398"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-0994",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0994"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-0994",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0994"
},
{
"category": "external",
"summary": "https://github.com/protocolbuffers/protobuf/pull/25239",
"url": "https://github.com/protocolbuffers/protobuf/pull/25239"
}
],
"release_date": "2026-01-23T14:55:16.876000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-17T11:10:51+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:8746",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8746"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "python: protobuf: Protobuf: Denial of Service due to recursion depth bypass"
},
{
"cve": "CVE-2026-1299",
"cwe": {
"id": "CWE-93",
"name": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)"
},
"discovery_date": "2026-01-23T17:02:57.343486+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2432437"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the email module in the Python standard library. When serializing an email message, the BytesGenerator class fails to properly quote newline characters for email headers. This issue is exploitable when the LiteralHeader class is used as it does not respect email folding rules, allowing an attacker to inject email headers and potentially modify message recipients or the email body, and spoof sender information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "cpython: email header injection due to unquoted newlines",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue can only be exploitable by Python applications using the LiteralHeader class to write email headers, as it does not respect email folding rules. Additionally, this issue allows attackers to modify message recipients or the email body and spoof sender identity but it does not cause memory corruption or arbitrary code execution. Due to these reasons, this vulnerability has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-1299"
},
{
"category": "external",
"summary": "RHBZ#2432437",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2432437"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-1299",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-1299"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-1299",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1299"
},
{
"category": "external",
"summary": "https://cve.org/CVERecord?id=CVE-2024-6923",
"url": "https://cve.org/CVERecord?id=CVE-2024-6923"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/commit/052e55e7d44718fe46cbba0ca995cb8fcc359413",
"url": "https://github.com/python/cpython/commit/052e55e7d44718fe46cbba0ca995cb8fcc359413"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/issues/144125",
"url": "https://github.com/python/cpython/issues/144125"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/pull/144126",
"url": "https://github.com/python/cpython/pull/144126"
},
{
"category": "external",
"summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/6ZZULGALJTITEAGEXLDJE2C6FORDXPBT/",
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/6ZZULGALJTITEAGEXLDJE2C6FORDXPBT/"
}
],
"release_date": "2026-01-23T16:27:13.346000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-17T11:10:51+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:8746",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8746"
},
{
"category": "workaround",
"details": "To mitigate this issue, applications accepting user-supplied data for email headers should sanitize the input by stripping or rejecting any strings containing carriage return or line feed characters, \u0027\\r\u0027 or \u0027\\n\u0027, respectively, preventing malicious sequences that could lead to header manipulation.",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "cpython: email header injection due to unquoted newlines"
},
{
"cve": "CVE-2026-2447",
"discovery_date": "2026-02-16T15:01:25.122593+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2440219"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue: Heap buffer overflow in libvpx.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libvpx: Heap buffer overflow in libvpx",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-2447"
},
{
"category": "external",
"summary": "RHBZ#2440219",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2440219"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-2447",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2447"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2447",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2447"
},
{
"category": "external",
"summary": "https://bugzilla.mozilla.org/show_bug.cgi?id=2014390",
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2014390"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-10/",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-10/"
}
],
"release_date": "2026-02-16T14:13:23.559000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-17T11:10:51+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:8746",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8746"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "libvpx: Heap buffer overflow in libvpx"
},
{
"acknowledgments": [
{
"names": [
"Elhanan Haenel"
]
}
],
"cve": "CVE-2026-4111",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
},
"discovery_date": "2026-03-11T11:18:51.609000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2446453"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically within the archive_read_data() processing path. When a specially crafted RAR5 archive is processed, the decompression routine may enter a state where internal logic prevents forward progress. This condition results in an infinite loop that continuously consumes CPU resources. Because the archive passes checksum validation and appears structurally valid, affected applications cannot detect the issue before processing. This can allow attackers to cause persistent denial-of-service conditions in services that automatically process archives.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libarchive: Infinite Loop Denial of Service in RAR5 Decompression via archive_read_data() in libarchive",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Red Hat Product Security team would likely assess the severity of this vulnerability as High because it allows remote attackers to cause a persistent denial-of-service condition using a small crafted archive file. Successful exploitation requires no authentication, no special configuration, and no user interaction in environments that automatically process uploaded archives. By repeatedly submitting malicious archives, an attacker can exhaust CPU resources or worker threads in services such as file upload systems, CI/CD pipelines, mail scanners, and content indexing services that rely on libarchive for archive extraction.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4111"
},
{
"category": "external",
"summary": "RHBZ#2446453",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2446453"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4111",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4111"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4111",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4111"
},
{
"category": "external",
"summary": "https://github.com/libarchive/libarchive/pull/2877",
"url": "https://github.com/libarchive/libarchive/pull/2877"
}
],
"release_date": "2026-03-11T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-17T11:10:51+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:8746",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8746"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "libarchive: Infinite Loop Denial of Service in RAR5 Decompression via archive_read_data() in libarchive"
},
{
"cve": "CVE-2026-4519",
"cwe": {
"id": "CWE-88",
"name": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)"
},
"discovery_date": "2026-03-20T16:02:13.494105+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2449649"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Python. The `webbrowser.open()` API, used to launch web browsers, does not properly sanitize input. This allows a remote attacker to craft a malicious URL containing leading dashes. When such a URL is opened, certain web browsers may interpret these dashes as command-line options, which could lead to unexpected behavior, information disclosure, or potentially arbitrary code execution, impacting the integrity of the system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python: Python: Command-line option injection in webbrowser.open() via crafted URLs",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4519"
},
{
"category": "external",
"summary": "RHBZ#2449649",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449649"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4519",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4519"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4519",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4519"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/issues/143930",
"url": "https://github.com/python/cpython/issues/143930"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/pull/143931",
"url": "https://github.com/python/cpython/pull/143931"
},
{
"category": "external",
"summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/AY5NDSS433JK56Q7Q5IS7B37QFZVVOUS/",
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/AY5NDSS433JK56Q7Q5IS7B37QFZVVOUS/"
}
],
"release_date": "2026-03-20T15:08:32.576000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-17T11:10:51+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:8746",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8746"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"products": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "python: Python: Command-line option injection in webbrowser.open() via crafted URLs"
},
{
"cve": "CVE-2026-22695",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2026-01-13T00:08:52.403246+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2428825"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libpng, a reference library for processing PNG (Portable Network Graphics) image files. A local attacker could exploit a heap buffer over-read vulnerability in the `png_image_finish_read` function by tricking a user into processing a specially crafted interlaced 16-bit PNG file with an 8-bit output format and non-minimal row stride. This could lead to a denial of service (DoS) and potentially information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libpng: libpng: Denial of service and information disclosure via heap buffer over-read in png_image_finish_read",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Moderate for Red Hat products. A heap buffer over-read flaw exists in the libpng library when processing specially crafted interlaced 16-bit PNG images with 8-bit output format and non-minimal row stride. This issue requires user interaction, as an attacker would need to trick a user into opening a malicious PNG file.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-22695"
},
{
"category": "external",
"summary": "RHBZ#2428825",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2428825"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-22695",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-22695"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-22695",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22695"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/commit/218612ddd6b17944e21eda56caf8b4bf7779d1ea",
"url": "https://github.com/pnggroup/libpng/commit/218612ddd6b17944e21eda56caf8b4bf7779d1ea"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/commit/e4f7ad4ea2",
"url": "https://github.com/pnggroup/libpng/commit/e4f7ad4ea2"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/issues/778",
"url": "https://github.com/pnggroup/libpng/issues/778"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/security/advisories/GHSA-mmq5-27w3-rxpp",
"url": "https://github.com/pnggroup/libpng/security/advisories/GHSA-mmq5-27w3-rxpp"
}
],
"release_date": "2026-01-12T22:55:40.204000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-17T11:10:51+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:8746",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8746"
},
{
"category": "workaround",
"details": "To mitigate this issue, users should avoid opening untrusted PNG image files. Applications that process PNG images should be configured to restrict processing of untrusted or unverified content where possible.",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libpng: libpng: Denial of service and information disclosure via heap buffer over-read in png_image_finish_read"
},
{
"cve": "CVE-2026-22801",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2026-01-13T00:08:42.581146+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2428824"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libpng, a reference library for PNG (Portable Network Graphics) raster image files. An integer truncation vulnerability exists in the png_write_image_16bit and png_write_image_8bit simplified write API functions. A local attacker could exploit this flaw by providing a negative row stride (for bottom-up image layouts) or a stride exceeding 65535 bytes, leading to a heap buffer over-read. This can result in information disclosure or a denial of service (DoS) to the system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libpng: libpng: Information disclosure and denial of service via integer truncation in simplified write API",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Moderate for Red Hat products. An integer truncation flaw in the libpng simplified write API functions (`png_write_image_16bit`, `png_write_image_8bit`) can lead to a heap buffer over-read. Exploitation requires an application to process specially crafted input that provides a negative row stride or a stride exceeding 65535 bytes, potentially resulting in denial of service or information disclosure.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-22801"
},
{
"category": "external",
"summary": "RHBZ#2428824",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2428824"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-22801",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-22801"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-22801",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22801"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/security/advisories/GHSA-vgjq-8cw5-ggw8",
"url": "https://github.com/pnggroup/libpng/security/advisories/GHSA-vgjq-8cw5-ggw8"
}
],
"release_date": "2026-01-12T22:57:58.288000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-17T11:10:51+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:8746",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8746"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"products": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libpng: libpng: Information disclosure and denial of service via integer truncation in simplified write API"
},
{
"cve": "CVE-2026-25646",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2026-02-10T18:01:28.232408+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2438542"
}
],
"notes": [
{
"category": "description",
"text": "A heap based buffer overflow flaw has been discovered in LibPNG. Prior to version 1.6.55, an out-of-bounds read vulnerability exists in the png_set_quantize() API function. When the function is called with no histogram and the number of colors in the palette is more than twice the maximum supported by the user\u0027s display, certain palettes will cause the function to enter into an infinite loop that reads past the end of an internal heap-allocated buffer. The images that trigger this vulnerability are valid per the PNG specification.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libpng: LIBPNG has a heap buffer overflow in png_set_quantize",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-25646"
},
{
"category": "external",
"summary": "RHBZ#2438542",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2438542"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-25646",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25646"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25646",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25646"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/02/09/7",
"url": "http://www.openwall.com/lists/oss-security/2026/02/09/7"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/commit/01d03b8453eb30ade759cd45c707e5a1c7277d88",
"url": "https://github.com/pnggroup/libpng/commit/01d03b8453eb30ade759cd45c707e5a1c7277d88"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/security/advisories/GHSA-g8hp-mq4h-rqm3",
"url": "https://github.com/pnggroup/libpng/security/advisories/GHSA-g8hp-mq4h-rqm3"
}
],
"release_date": "2026-02-10T17:04:38.501000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-17T11:10:51+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:8746",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8746"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"products": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "libpng: LIBPNG has a heap buffer overflow in png_set_quantize"
},
{
"cve": "CVE-2026-27893",
"cwe": {
"id": "CWE-501",
"name": "Trust Boundary Violation"
},
"discovery_date": "2026-03-27T00:01:43.935417+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2452055"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in vLLM, an inference and serving engine for large language models (LLMs). Two model implementation files hardcode `trust_remote_code=True` when loading sub-components. This bypasses the user\u0027s explicit `--trust-remote-code=False` security opt-out, allowing a remote attacker to achieve remote code execution through malicious model repositories.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "vllm: vLLM: Remote code execution due to hardcoded trust_remote_code setting",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important vulnerability in vLLM, as shipped in Red Hat AI Inference Server and Red Hat OpenShift AI. The flaw allows remote code execution due to vLLM hardcoding `trust_remote_code=True` when loading sub-components, which bypasses the user\u0027s explicit `--trust-remote-code=False` security opt-out. This can lead to exploitation through malicious model repositories.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27893"
},
{
"category": "external",
"summary": "RHBZ#2452055",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2452055"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27893",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27893"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27893",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27893"
},
{
"category": "external",
"summary": "https://github.com/vllm-project/vllm/commit/00bd08edeee5dd4d4c13277c0114a464011acf72",
"url": "https://github.com/vllm-project/vllm/commit/00bd08edeee5dd4d4c13277c0114a464011acf72"
},
{
"category": "external",
"summary": "https://github.com/vllm-project/vllm/pull/36192",
"url": "https://github.com/vllm-project/vllm/pull/36192"
},
{
"category": "external",
"summary": "https://github.com/vllm-project/vllm/security/advisories/GHSA-7972-pg2x-xr59",
"url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-7972-pg2x-xr59"
}
],
"release_date": "2026-03-26T23:56:53.579000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-17T11:10:51+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:8746",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8746"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "vllm: vLLM: Remote code execution due to hardcoded trust_remote_code setting"
},
{
"cve": "CVE-2026-32597",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-03-12T22:01:29.967713+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2447194"
}
],
"notes": [
{
"category": "description",
"text": "A missing verification step has been discovered in PyJWT. PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 \u00a74.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 \u00a74.1.11 MUST violation)",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32597"
},
{
"category": "external",
"summary": "RHBZ#2447194",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447194"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32597",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32597"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32597",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32597"
},
{
"category": "external",
"summary": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-752w-5fwx-jx9f",
"url": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-752w-5fwx-jx9f"
}
],
"release_date": "2026-03-12T21:41:50.427000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-17T11:10:51+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:8746",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8746"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:0ec114881d9dcd28a5dbbb2ec0ea1301ad87d5ae133121ce8167ef29d19802cc_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:575090d65efcc6da0ea21e21484ac210357983e1c9031dfba8cf32a1b18b3c0a_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 \u00a74.1.11 MUST violation)"
}
]
}
RHSA-2026:8747
Vulnerability from csaf_redhat - Published: 2026-04-17 11:10 - Updated: 2026-08-08 16:33Summary
Red Hat Security Advisory: Red Hat AI Inference Server 3.3.1 (ROCm)
Severity
Important
Notes
Topic: Red Hat AI Inference Server 3.3.1 (ROCm) is now available.
Details: Red Hat® AI Inference Server
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in libxslt package. Processing web content may disclose sensitive information. This issue was addressed with improved memory handling.
6.5 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892_amd64 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
A segment fault (SEGV) flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFReadRGBATileExt() API. This flaw allows a remote attacker to cause a heap-buffer overflow, leading to a denial of service.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892_amd64 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
A flaw was found in the http.client module in the Python standard library. When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This issue allows a malicious server to cause the client to read large amounts of data into memory, potentially causing memory allocations errors, swapping, out-of-memory conditions or even system freezes.
6.8 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in GnuTLS. This vulnerability allows a denial of service (DoS) by excessive CPU (Central Processing Unit) and memory consumption via specially crafted malicious certificates containing a large number of name constraints and subject alternative names (SANs).
5.3 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892_amd64 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
A flaw was found in the imaplib module in the Python standard library. The imaplib module does not reject control characters, such as newlines, in user-controlled input passed to IMAP commands. This issue allows an attacker to inject additional commands to be executed in the IMAP server.
7.1 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in the poplib module in the Python standard library. The poplib module does not reject control characters, such as newlines, in user-controlled input passed to POP3 commands. This issue allows an attacker to inject additional commands to be executed in the POP3 server.
7.1 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in protobuf. A remote attacker can exploit this denial-of-service (DoS) vulnerability by supplying deeply nested `google.protobuf.Any` messages to the `google.protobuf.json_format.ParseDict()` function. This bypasses the intended recursion depth limit, leading to the exhaustion of Python’s recursion stack and causing a `RecursionError`, which results in a denial of service.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in the email module in the Python standard library. When serializing an email message, the BytesGenerator class fails to properly quote newline characters for email headers. This issue is exploitable when the LiteralHeader class is used as it does not respect email folding rules, allowing an attacker to inject email headers and potentially modify message recipients or the email body, and spoof sender information.
7.1 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Heap buffer overflow in libvpx.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically within the archive_read_data() processing path. When a specially crafted RAR5 archive is processed, the decompression routine may enter a state where internal logic prevents forward progress. This condition results in an infinite loop that continuously consumes CPU resources. Because the archive passes checksum validation and appears structurally valid, affected applications cannot detect the issue before processing. This can allow attackers to cause persistent denial-of-service conditions in services that automatically process archives.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Python. The `webbrowser.open()` API, used to launch web browsers, does not properly sanitize input. This allows a remote attacker to craft a malicious URL containing leading dashes. When such a URL is opened, certain web browsers may interpret these dashes as command-line options, which could lead to unexpected behavior, information disclosure, or potentially arbitrary code execution, impacting the integrity of the system.
7.1 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in libpng, a reference library for processing PNG (Portable Network Graphics) image files. A local attacker could exploit a heap buffer over-read vulnerability in the `png_image_finish_read` function by tricking a user into processing a specially crafted interlaced 16-bit PNG file with an 8-bit output format and non-minimal row stride. This could lead to a denial of service (DoS) and potentially information disclosure.
6.1 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in libpng, a reference library for PNG (Portable Network Graphics) raster image files. An integer truncation vulnerability exists in the png_write_image_16bit and png_write_image_8bit simplified write API functions. A local attacker could exploit this flaw by providing a negative row stride (for bottom-up image layouts) or a stride exceeding 65535 bytes, leading to a heap buffer over-read. This can result in information disclosure or a denial of service (DoS) to the system.
6.6 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A heap based buffer overflow flaw has been discovered in LibPNG. Prior to version 1.6.55, an out-of-bounds read vulnerability exists in the png_set_quantize() API function. When the function is called with no histogram and the number of colors in the palette is more than twice the maximum supported by the user's display, certain palettes will cause the function to enter into an infinite loop that reads past the end of an internal heap-allocated buffer. The images that trigger this vulnerability are valid per the PNG specification.
7.0 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in vLLM, an inference and serving engine for large language models (LLMs). Two model implementation files hardcode `trust_remote_code=True` when loading sub-components. This bypasses the user's explicit `--trust-remote-code=False` security opt-out, allowing a remote attacker to achieve remote code execution through malicious model repositories.
8.8 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A missing verification step has been discovered in PyJWT. PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
References
130 references
Acknowledgments
Elhanan Haenel
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat AI Inference Server 3.3.1 (ROCm) is now available.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat\u00ae AI Inference Server",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:8747",
"url": "https://access.redhat.com/errata/RHSA-2026:8747"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2023-40403",
"url": "https://access.redhat.com/security/cve/CVE-2023-40403"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2023-52356",
"url": "https://access.redhat.com/security/cve/CVE-2023-52356"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-13836",
"url": "https://access.redhat.com/security/cve/CVE-2025-13836"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-14831",
"url": "https://access.redhat.com/security/cve/CVE-2025-14831"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-15366",
"url": "https://access.redhat.com/security/cve/CVE-2025-15366"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-15367",
"url": "https://access.redhat.com/security/cve/CVE-2025-15367"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-0994",
"url": "https://access.redhat.com/security/cve/CVE-2026-0994"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-1299",
"url": "https://access.redhat.com/security/cve/CVE-2026-1299"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-22695",
"url": "https://access.redhat.com/security/cve/CVE-2026-22695"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-22801",
"url": "https://access.redhat.com/security/cve/CVE-2026-22801"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-2447",
"url": "https://access.redhat.com/security/cve/CVE-2026-2447"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-25646",
"url": "https://access.redhat.com/security/cve/CVE-2026-25646"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-27893",
"url": "https://access.redhat.com/security/cve/CVE-2026-27893"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32597",
"url": "https://access.redhat.com/security/cve/CVE-2026-32597"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-4111",
"url": "https://access.redhat.com/security/cve/CVE-2026-4111"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-4519",
"url": "https://access.redhat.com/security/cve/CVE-2026-4519"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://www.redhat.com/en/products/ai/inference-server",
"url": "https://www.redhat.com/en/products/ai/inference-server"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_8747.json"
}
],
"title": "Red Hat Security Advisory: Red Hat AI Inference Server 3.3.1 (ROCm)",
"tracking": {
"current_release_date": "2026-08-08T16:33:57+00:00",
"generator": {
"date": "2026-08-08T16:33:57+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.12"
}
},
"id": "RHSA-2026:8747",
"initial_release_date": "2026-04-17T11:10:50+00:00",
"revision_history": [
{
"date": "2026-04-17T11:10:50+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-08-08T04:36:23+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-08T16:33:57+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat AI Inference Server 3.3",
"product": {
"name": "Red Hat AI Inference Server 3.3",
"product_id": "Red Hat AI Inference Server 3.3",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:ai_inference_server:3.3::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat AI Inference Server"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892_amd64",
"product": {
"name": "registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892_amd64",
"product_id": "registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892_amd64",
"product_identification_helper": {
"purl": "pkg:oci/vllm-rocm-rhel9@sha256%3A813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892?arch=amd64\u0026repository_url=registry.redhat.io/rhaiis\u0026tag=1775680262"
}
}
}
],
"category": "architecture",
"name": "amd64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892_amd64 as a component of Red Hat AI Inference Server 3.3",
"product_id": "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892_amd64"
},
"product_reference": "registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892_amd64",
"relates_to_product_reference": "Red Hat AI Inference Server 3.3"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2023-40403",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2025-03-04T12:01:50.826520+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2349766"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libxslt package. Processing web content may disclose sensitive information. This issue was addressed with improved memory handling.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxslt: Processing web content may disclose sensitive information",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This CVE is a duplicate of CVE-2022-4909.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2023-40403"
},
{
"category": "external",
"summary": "RHBZ#2349766",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2349766"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2023-40403",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-40403"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-40403",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40403"
},
{
"category": "external",
"summary": "http://seclists.org/fulldisclosure/2023/Oct/10",
"url": "http://seclists.org/fulldisclosure/2023/Oct/10"
},
{
"category": "external",
"summary": "http://seclists.org/fulldisclosure/2023/Oct/3",
"url": "http://seclists.org/fulldisclosure/2023/Oct/3"
},
{
"category": "external",
"summary": "http://seclists.org/fulldisclosure/2023/Oct/4",
"url": "http://seclists.org/fulldisclosure/2023/Oct/4"
},
{
"category": "external",
"summary": "http://seclists.org/fulldisclosure/2023/Oct/5",
"url": "http://seclists.org/fulldisclosure/2023/Oct/5"
},
{
"category": "external",
"summary": "http://seclists.org/fulldisclosure/2023/Oct/6",
"url": "http://seclists.org/fulldisclosure/2023/Oct/6"
},
{
"category": "external",
"summary": "http://seclists.org/fulldisclosure/2023/Oct/8",
"url": "http://seclists.org/fulldisclosure/2023/Oct/8"
},
{
"category": "external",
"summary": "http://seclists.org/fulldisclosure/2023/Oct/9",
"url": "http://seclists.org/fulldisclosure/2023/Oct/9"
},
{
"category": "external",
"summary": "https://bugs.chromium.org/p/chromium/issues/detail?id=1356211",
"url": "https://bugs.chromium.org/p/chromium/issues/detail?id=1356211"
},
{
"category": "external",
"summary": "https://bugzilla.gnome.org/show_bug.cgi?id=751621",
"url": "https://bugzilla.gnome.org/show_bug.cgi?id=751621"
},
{
"category": "external",
"summary": "https://gitlab.gnome.org/GNOME/libxslt/-/issues/94",
"url": "https://gitlab.gnome.org/GNOME/libxslt/-/issues/94"
},
{
"category": "external",
"summary": "https://support.apple.com/en-us/HT213927",
"url": "https://support.apple.com/en-us/HT213927"
}
],
"release_date": "2023-09-26T20:14:54.697000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-17T11:10:50+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:8747",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8747"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libxslt: Processing web content may disclose sensitive information"
},
{
"cve": "CVE-2023-52356",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2023-11-24T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2251344"
}
],
"notes": [
{
"category": "description",
"text": "A segment fault (SEGV) flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFReadRGBATileExt() API. This flaw allows a remote attacker to cause a heap-buffer overflow, leading to a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libtiff: Segment fault in libtiff in TIFFReadRGBATileExt() leading to denial of service",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The flaw allows an attacker to potentially cause a denial of service attack by crashing a program, but the impact is minimal.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2023-52356"
},
{
"category": "external",
"summary": "RHBZ#2251344",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2251344"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2023-52356",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-52356"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-52356",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-52356"
},
{
"category": "external",
"summary": "https://gitlab.com/libtiff/libtiff/-/issues/622",
"url": "https://gitlab.com/libtiff/libtiff/-/issues/622"
},
{
"category": "external",
"summary": "https://gitlab.com/libtiff/libtiff/-/merge_requests/546",
"url": "https://gitlab.com/libtiff/libtiff/-/merge_requests/546"
}
],
"release_date": "2023-11-03T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-17T11:10:50+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:8747",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8747"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libtiff: Segment fault in libtiff in TIFFReadRGBATileExt() leading to denial of service"
},
{
"cve": "CVE-2025-13836",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2025-12-01T19:01:03.091899+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2418078"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the http.client module in the Python standard library. When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This issue allows a malicious server to cause the client to read large amounts of data into memory, potentially causing memory allocations errors, swapping, out-of-memory conditions or even system freezes.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "cpython: Excessive read buffering DoS in http.client",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue can only be exploited by Python applications using the http.client.HTTPResponse.read function without the amount parameter, which specifies the read size in bytes. Note that Python libraries may use this function internally and make applications vulnerable. Additionally, vulnerable Python applications must connect to a malicious or compromised server that replies with a very large or crafted Content-Length header to trigger this issue, limiting the exposure of this vulnerability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-13836"
},
{
"category": "external",
"summary": "RHBZ#2418078",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418078"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-13836",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-13836"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-13836",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13836"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/issues/119451",
"url": "https://github.com/python/cpython/issues/119451"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/pull/119454",
"url": "https://github.com/python/cpython/pull/119454"
}
],
"release_date": "2025-12-01T18:02:38.483000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-17T11:10:50+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:8747",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8747"
},
{
"category": "workaround",
"details": "Since this vulnerability is triggered when no read amount is specified and the client defaults to using the potentially malicious Content-Length header, developers can mitigate this issue in their code by always imposing an explicit, safe limit on data reads.\n\nApplications using the http.client.HTTPResponse.read function directly can ensure that read operations specify a byte limit:\n\n~~~\n...\nmax_safe_read = 10 * 1024 * 1024\ndata = response.read(max_safe_read)\n...\n~~~",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "cpython: Excessive read buffering DoS in http.client"
},
{
"cve": "CVE-2025-14831",
"cwe": {
"id": "CWE-407",
"name": "Inefficient Algorithmic Complexity"
},
"discovery_date": "2025-12-17T14:48:30.222000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2423177"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in GnuTLS. This vulnerability allows a denial of service (DoS) by excessive CPU (Central Processing Unit) and memory consumption via specially crafted malicious certificates containing a large number of name constraints and subject alternative names (SANs).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "gnutls: GnuTLS: Denial of Service via excessive resource consumption during certificate verification",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Moderate for Red Hat. GnuTLS is susceptible to a denial of service attack due to excessive CPU and memory consumption. This occurs when processing specially crafted malicious certificates containing a large number of name constraints and subject alternative names (SANs) during certificate verification.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-14831"
},
{
"category": "external",
"summary": "RHBZ#2423177",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2423177"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-14831",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-14831"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-14831",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14831"
},
{
"category": "external",
"summary": "https://gitlab.com/gnutls/gnutls/-/issues/1773",
"url": "https://gitlab.com/gnutls/gnutls/-/issues/1773"
}
],
"release_date": "2026-02-09T14:26:34.939000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-17T11:10:50+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:8747",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8747"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "gnutls: GnuTLS: Denial of Service via excessive resource consumption during certificate verification"
},
{
"cve": "CVE-2025-15366",
"cwe": {
"id": "CWE-77",
"name": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)"
},
"discovery_date": "2026-01-20T22:01:33.257688+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2431368"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the imaplib module in the Python standard library. The imaplib module does not reject control characters, such as newlines, in user-controlled input passed to IMAP commands. This issue allows an attacker to inject additional commands to be executed in the IMAP server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "cpython: IMAP command injection in user-controlled commands",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to have the privileges required to send malicious input to an application that sends IMAP commands to a server. Additionally, this flaw can allow attackers to manipulate the state of the mailbox (e.g., delete emails, move folders, flag messages) and to potentially read metadata or specific email content, but it does not allow arbitrary code execution or OS command injection. Due to these reasons, this issue has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-15366"
},
{
"category": "external",
"summary": "RHBZ#2431368",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431368"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-15366",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-15366"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-15366",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15366"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/issues/143921",
"url": "https://github.com/python/cpython/issues/143921"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/pull/143922",
"url": "https://github.com/python/cpython/pull/143922"
},
{
"category": "external",
"summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/DD7C7JZJYTBXMDOWKCEIEBJLBRU64OMR/",
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/DD7C7JZJYTBXMDOWKCEIEBJLBRU64OMR/"
}
],
"release_date": "2026-01-20T21:40:24.938000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-17T11:10:50+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:8747",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8747"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, ensure that no data passed to the imaplib module contains newline or carriage return characters.",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "cpython: IMAP command injection in user-controlled commands"
},
{
"cve": "CVE-2025-15367",
"cwe": {
"id": "CWE-77",
"name": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)"
},
"discovery_date": "2026-01-20T22:02:09.399038+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2431373"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the poplib module in the Python standard library. The poplib module does not reject control characters, such as newlines, in user-controlled input passed to POP3 commands. This issue allows an attacker to inject additional commands to be executed in the POP3 server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "cpython: POP3 command injection in user-controlled commands",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to have the privileges required to send malicious input to an application that sends POP3 commands to a server. Additionally, this flaw can allow attackers to manipulate the state of the mailbox (e.g., delete emails) and to potentially read metadata or specific email content, but it does not allow arbitrary code execution or OS command injection. Due to these reasons, this issue has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-15367"
},
{
"category": "external",
"summary": "RHBZ#2431373",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431373"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-15367",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-15367"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-15367",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15367"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/issues/143923",
"url": "https://github.com/python/cpython/issues/143923"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/pull/143924",
"url": "https://github.com/python/cpython/pull/143924"
},
{
"category": "external",
"summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/CBFBOWVGGUJFSGITQCCBZS4GEYYZ7ZNE/",
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/CBFBOWVGGUJFSGITQCCBZS4GEYYZ7ZNE/"
}
],
"release_date": "2026-01-20T21:47:09.885000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-17T11:10:50+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:8747",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8747"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, ensure that no data passed to the poplib module contains newline or carriage return characters.",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "cpython: POP3 command injection in user-controlled commands"
},
{
"cve": "CVE-2026-0994",
"cwe": {
"id": "CWE-674",
"name": "Uncontrolled Recursion"
},
"discovery_date": "2026-01-23T16:02:59.235878+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2432398"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in protobuf. A remote attacker can exploit this denial-of-service (DoS) vulnerability by supplying deeply nested `google.protobuf.Any` messages to the `google.protobuf.json_format.ParseDict()` function. This bypasses the intended recursion depth limit, leading to the exhaustion of Python\u2019s recursion stack and causing a `RecursionError`, which results in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python: protobuf: Protobuf: Denial of Service due to recursion depth bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Important for Red Hat products. The flaw in `protobuf` allows a remote attacker to trigger a denial-of-service by providing specially crafted, deeply nested `google.protobuf.Any` messages to the `google.protobuf.json_format.ParseDict()` function. This bypasses the intended recursion depth limit, leading to resource exhaustion and application crashes.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-0994"
},
{
"category": "external",
"summary": "RHBZ#2432398",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2432398"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-0994",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0994"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-0994",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0994"
},
{
"category": "external",
"summary": "https://github.com/protocolbuffers/protobuf/pull/25239",
"url": "https://github.com/protocolbuffers/protobuf/pull/25239"
}
],
"release_date": "2026-01-23T14:55:16.876000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-17T11:10:50+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:8747",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8747"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "python: protobuf: Protobuf: Denial of Service due to recursion depth bypass"
},
{
"cve": "CVE-2026-1299",
"cwe": {
"id": "CWE-93",
"name": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)"
},
"discovery_date": "2026-01-23T17:02:57.343486+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2432437"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the email module in the Python standard library. When serializing an email message, the BytesGenerator class fails to properly quote newline characters for email headers. This issue is exploitable when the LiteralHeader class is used as it does not respect email folding rules, allowing an attacker to inject email headers and potentially modify message recipients or the email body, and spoof sender information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "cpython: email header injection due to unquoted newlines",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue can only be exploitable by Python applications using the LiteralHeader class to write email headers, as it does not respect email folding rules. Additionally, this issue allows attackers to modify message recipients or the email body and spoof sender identity but it does not cause memory corruption or arbitrary code execution. Due to these reasons, this vulnerability has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-1299"
},
{
"category": "external",
"summary": "RHBZ#2432437",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2432437"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-1299",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-1299"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-1299",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1299"
},
{
"category": "external",
"summary": "https://cve.org/CVERecord?id=CVE-2024-6923",
"url": "https://cve.org/CVERecord?id=CVE-2024-6923"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/commit/052e55e7d44718fe46cbba0ca995cb8fcc359413",
"url": "https://github.com/python/cpython/commit/052e55e7d44718fe46cbba0ca995cb8fcc359413"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/issues/144125",
"url": "https://github.com/python/cpython/issues/144125"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/pull/144126",
"url": "https://github.com/python/cpython/pull/144126"
},
{
"category": "external",
"summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/6ZZULGALJTITEAGEXLDJE2C6FORDXPBT/",
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/6ZZULGALJTITEAGEXLDJE2C6FORDXPBT/"
}
],
"release_date": "2026-01-23T16:27:13.346000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-17T11:10:50+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:8747",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8747"
},
{
"category": "workaround",
"details": "To mitigate this issue, applications accepting user-supplied data for email headers should sanitize the input by stripping or rejecting any strings containing carriage return or line feed characters, \u0027\\r\u0027 or \u0027\\n\u0027, respectively, preventing malicious sequences that could lead to header manipulation.",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "cpython: email header injection due to unquoted newlines"
},
{
"cve": "CVE-2026-2447",
"discovery_date": "2026-02-16T15:01:25.122593+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2440219"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue: Heap buffer overflow in libvpx.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libvpx: Heap buffer overflow in libvpx",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-2447"
},
{
"category": "external",
"summary": "RHBZ#2440219",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2440219"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-2447",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2447"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2447",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2447"
},
{
"category": "external",
"summary": "https://bugzilla.mozilla.org/show_bug.cgi?id=2014390",
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2014390"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-10/",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-10/"
}
],
"release_date": "2026-02-16T14:13:23.559000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-17T11:10:50+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:8747",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8747"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "libvpx: Heap buffer overflow in libvpx"
},
{
"acknowledgments": [
{
"names": [
"Elhanan Haenel"
]
}
],
"cve": "CVE-2026-4111",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
},
"discovery_date": "2026-03-11T11:18:51.609000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2446453"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically within the archive_read_data() processing path. When a specially crafted RAR5 archive is processed, the decompression routine may enter a state where internal logic prevents forward progress. This condition results in an infinite loop that continuously consumes CPU resources. Because the archive passes checksum validation and appears structurally valid, affected applications cannot detect the issue before processing. This can allow attackers to cause persistent denial-of-service conditions in services that automatically process archives.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libarchive: Infinite Loop Denial of Service in RAR5 Decompression via archive_read_data() in libarchive",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Red Hat Product Security team would likely assess the severity of this vulnerability as High because it allows remote attackers to cause a persistent denial-of-service condition using a small crafted archive file. Successful exploitation requires no authentication, no special configuration, and no user interaction in environments that automatically process uploaded archives. By repeatedly submitting malicious archives, an attacker can exhaust CPU resources or worker threads in services such as file upload systems, CI/CD pipelines, mail scanners, and content indexing services that rely on libarchive for archive extraction.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4111"
},
{
"category": "external",
"summary": "RHBZ#2446453",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2446453"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4111",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4111"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4111",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4111"
},
{
"category": "external",
"summary": "https://github.com/libarchive/libarchive/pull/2877",
"url": "https://github.com/libarchive/libarchive/pull/2877"
}
],
"release_date": "2026-03-11T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-17T11:10:50+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:8747",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8747"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "libarchive: Infinite Loop Denial of Service in RAR5 Decompression via archive_read_data() in libarchive"
},
{
"cve": "CVE-2026-4519",
"cwe": {
"id": "CWE-88",
"name": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)"
},
"discovery_date": "2026-03-20T16:02:13.494105+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2449649"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Python. The `webbrowser.open()` API, used to launch web browsers, does not properly sanitize input. This allows a remote attacker to craft a malicious URL containing leading dashes. When such a URL is opened, certain web browsers may interpret these dashes as command-line options, which could lead to unexpected behavior, information disclosure, or potentially arbitrary code execution, impacting the integrity of the system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python: Python: Command-line option injection in webbrowser.open() via crafted URLs",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4519"
},
{
"category": "external",
"summary": "RHBZ#2449649",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449649"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4519",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4519"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4519",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4519"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/issues/143930",
"url": "https://github.com/python/cpython/issues/143930"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/pull/143931",
"url": "https://github.com/python/cpython/pull/143931"
},
{
"category": "external",
"summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/AY5NDSS433JK56Q7Q5IS7B37QFZVVOUS/",
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/AY5NDSS433JK56Q7Q5IS7B37QFZVVOUS/"
}
],
"release_date": "2026-03-20T15:08:32.576000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-17T11:10:50+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:8747",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8747"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"products": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "python: Python: Command-line option injection in webbrowser.open() via crafted URLs"
},
{
"cve": "CVE-2026-22695",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2026-01-13T00:08:52.403246+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2428825"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libpng, a reference library for processing PNG (Portable Network Graphics) image files. A local attacker could exploit a heap buffer over-read vulnerability in the `png_image_finish_read` function by tricking a user into processing a specially crafted interlaced 16-bit PNG file with an 8-bit output format and non-minimal row stride. This could lead to a denial of service (DoS) and potentially information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libpng: libpng: Denial of service and information disclosure via heap buffer over-read in png_image_finish_read",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Moderate for Red Hat products. A heap buffer over-read flaw exists in the libpng library when processing specially crafted interlaced 16-bit PNG images with 8-bit output format and non-minimal row stride. This issue requires user interaction, as an attacker would need to trick a user into opening a malicious PNG file.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-22695"
},
{
"category": "external",
"summary": "RHBZ#2428825",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2428825"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-22695",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-22695"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-22695",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22695"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/commit/218612ddd6b17944e21eda56caf8b4bf7779d1ea",
"url": "https://github.com/pnggroup/libpng/commit/218612ddd6b17944e21eda56caf8b4bf7779d1ea"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/commit/e4f7ad4ea2",
"url": "https://github.com/pnggroup/libpng/commit/e4f7ad4ea2"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/issues/778",
"url": "https://github.com/pnggroup/libpng/issues/778"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/security/advisories/GHSA-mmq5-27w3-rxpp",
"url": "https://github.com/pnggroup/libpng/security/advisories/GHSA-mmq5-27w3-rxpp"
}
],
"release_date": "2026-01-12T22:55:40.204000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-17T11:10:50+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:8747",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8747"
},
{
"category": "workaround",
"details": "To mitigate this issue, users should avoid opening untrusted PNG image files. Applications that process PNG images should be configured to restrict processing of untrusted or unverified content where possible.",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libpng: libpng: Denial of service and information disclosure via heap buffer over-read in png_image_finish_read"
},
{
"cve": "CVE-2026-22801",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2026-01-13T00:08:42.581146+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2428824"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libpng, a reference library for PNG (Portable Network Graphics) raster image files. An integer truncation vulnerability exists in the png_write_image_16bit and png_write_image_8bit simplified write API functions. A local attacker could exploit this flaw by providing a negative row stride (for bottom-up image layouts) or a stride exceeding 65535 bytes, leading to a heap buffer over-read. This can result in information disclosure or a denial of service (DoS) to the system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libpng: libpng: Information disclosure and denial of service via integer truncation in simplified write API",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Moderate for Red Hat products. An integer truncation flaw in the libpng simplified write API functions (`png_write_image_16bit`, `png_write_image_8bit`) can lead to a heap buffer over-read. Exploitation requires an application to process specially crafted input that provides a negative row stride or a stride exceeding 65535 bytes, potentially resulting in denial of service or information disclosure.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-22801"
},
{
"category": "external",
"summary": "RHBZ#2428824",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2428824"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-22801",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-22801"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-22801",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22801"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/security/advisories/GHSA-vgjq-8cw5-ggw8",
"url": "https://github.com/pnggroup/libpng/security/advisories/GHSA-vgjq-8cw5-ggw8"
}
],
"release_date": "2026-01-12T22:57:58.288000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-17T11:10:50+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:8747",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8747"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"products": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libpng: libpng: Information disclosure and denial of service via integer truncation in simplified write API"
},
{
"cve": "CVE-2026-25646",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2026-02-10T18:01:28.232408+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2438542"
}
],
"notes": [
{
"category": "description",
"text": "A heap based buffer overflow flaw has been discovered in LibPNG. Prior to version 1.6.55, an out-of-bounds read vulnerability exists in the png_set_quantize() API function. When the function is called with no histogram and the number of colors in the palette is more than twice the maximum supported by the user\u0027s display, certain palettes will cause the function to enter into an infinite loop that reads past the end of an internal heap-allocated buffer. The images that trigger this vulnerability are valid per the PNG specification.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libpng: LIBPNG has a heap buffer overflow in png_set_quantize",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-25646"
},
{
"category": "external",
"summary": "RHBZ#2438542",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2438542"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-25646",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25646"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25646",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25646"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/02/09/7",
"url": "http://www.openwall.com/lists/oss-security/2026/02/09/7"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/commit/01d03b8453eb30ade759cd45c707e5a1c7277d88",
"url": "https://github.com/pnggroup/libpng/commit/01d03b8453eb30ade759cd45c707e5a1c7277d88"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/security/advisories/GHSA-g8hp-mq4h-rqm3",
"url": "https://github.com/pnggroup/libpng/security/advisories/GHSA-g8hp-mq4h-rqm3"
}
],
"release_date": "2026-02-10T17:04:38.501000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-17T11:10:50+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:8747",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8747"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"products": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "libpng: LIBPNG has a heap buffer overflow in png_set_quantize"
},
{
"cve": "CVE-2026-27893",
"cwe": {
"id": "CWE-501",
"name": "Trust Boundary Violation"
},
"discovery_date": "2026-03-27T00:01:43.935417+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2452055"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in vLLM, an inference and serving engine for large language models (LLMs). Two model implementation files hardcode `trust_remote_code=True` when loading sub-components. This bypasses the user\u0027s explicit `--trust-remote-code=False` security opt-out, allowing a remote attacker to achieve remote code execution through malicious model repositories.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "vllm: vLLM: Remote code execution due to hardcoded trust_remote_code setting",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important vulnerability in vLLM, as shipped in Red Hat AI Inference Server and Red Hat OpenShift AI. The flaw allows remote code execution due to vLLM hardcoding `trust_remote_code=True` when loading sub-components, which bypasses the user\u0027s explicit `--trust-remote-code=False` security opt-out. This can lead to exploitation through malicious model repositories.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27893"
},
{
"category": "external",
"summary": "RHBZ#2452055",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2452055"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27893",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27893"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27893",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27893"
},
{
"category": "external",
"summary": "https://github.com/vllm-project/vllm/commit/00bd08edeee5dd4d4c13277c0114a464011acf72",
"url": "https://github.com/vllm-project/vllm/commit/00bd08edeee5dd4d4c13277c0114a464011acf72"
},
{
"category": "external",
"summary": "https://github.com/vllm-project/vllm/pull/36192",
"url": "https://github.com/vllm-project/vllm/pull/36192"
},
{
"category": "external",
"summary": "https://github.com/vllm-project/vllm/security/advisories/GHSA-7972-pg2x-xr59",
"url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-7972-pg2x-xr59"
}
],
"release_date": "2026-03-26T23:56:53.579000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-17T11:10:50+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:8747",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8747"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "vllm: vLLM: Remote code execution due to hardcoded trust_remote_code setting"
},
{
"cve": "CVE-2026-32597",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-03-12T22:01:29.967713+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2447194"
}
],
"notes": [
{
"category": "description",
"text": "A missing verification step has been discovered in PyJWT. PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 \u00a74.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 \u00a74.1.11 MUST violation)",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32597"
},
{
"category": "external",
"summary": "RHBZ#2447194",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447194"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32597",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32597"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32597",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32597"
},
{
"category": "external",
"summary": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-752w-5fwx-jx9f",
"url": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-752w-5fwx-jx9f"
}
],
"release_date": "2026-03-12T21:41:50.427000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-17T11:10:50+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:8747",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8747"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/vllm-rocm-rhel9@sha256:813ba7ccd1696b44deb90d9e6cd8af114bdb47781eae7f27246a81fba062a892_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 \u00a74.1.11 MUST violation)"
}
]
}
RHSA-2026:8748
Vulnerability from csaf_redhat - Published: 2026-04-17 11:11 - Updated: 2026-08-08 16:34Summary
Red Hat Security Advisory: Red Hat AI Inference Server Model Optimization Tools 3.3.1 (CUDA)
Severity
Important
Notes
Topic: Red Hat AI Inference Server Model Optimization Tools 3.3.1 (CUDA) is now available.
Details: Red Hat® AI Inference Server Model Optimization Tools
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in libxslt package. Processing web content may disclose sensitive information. This issue was addressed with improved memory handling.
6.5 (Medium)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
A segment fault (SEGV) flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFReadRGBATileExt() API. This flaw allows a remote attacker to cause a heap-buffer overflow, leading to a denial of service.
7.5 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
A flaw was found in the http.client module in the Python standard library. When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This issue allows a malicious server to cause the client to read large amounts of data into memory, potentially causing memory allocations errors, swapping, out-of-memory conditions or even system freezes.
6.8 (Medium)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in GnuTLS. This vulnerability allows a denial of service (DoS) by excessive CPU (Central Processing Unit) and memory consumption via specially crafted malicious certificates containing a large number of name constraints and subject alternative names (SANs).
5.3 (Medium)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
A flaw was found in the imaplib module in the Python standard library. The imaplib module does not reject control characters, such as newlines, in user-controlled input passed to IMAP commands. This issue allows an attacker to inject additional commands to be executed in the IMAP server.
7.1 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in the poplib module in the Python standard library. The poplib module does not reject control characters, such as newlines, in user-controlled input passed to POP3 commands. This issue allows an attacker to inject additional commands to be executed in the POP3 server.
7.1 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in protobuf. A remote attacker can exploit this denial-of-service (DoS) vulnerability by supplying deeply nested `google.protobuf.Any` messages to the `google.protobuf.json_format.ParseDict()` function. This bypasses the intended recursion depth limit, leading to the exhaustion of Python’s recursion stack and causing a `RecursionError`, which results in a denial of service.
7.5 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in the email module in the Python standard library. When serializing an email message, the BytesGenerator class fails to properly quote newline characters for email headers. This issue is exploitable when the LiteralHeader class is used as it does not respect email folding rules, allowing an attacker to inject email headers and potentially modify message recipients or the email body, and spoof sender information.
7.1 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Heap buffer overflow in libvpx.
7.5 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically within the archive_read_data() processing path. When a specially crafted RAR5 archive is processed, the decompression routine may enter a state where internal logic prevents forward progress. This condition results in an infinite loop that continuously consumes CPU resources. Because the archive passes checksum validation and appears structurally valid, affected applications cannot detect the issue before processing. This can allow attackers to cause persistent denial-of-service conditions in services that automatically process archives.
7.5 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Python. The `webbrowser.open()` API, used to launch web browsers, does not properly sanitize input. This allows a remote attacker to craft a malicious URL containing leading dashes. When such a URL is opened, certain web browsers may interpret these dashes as command-line options, which could lead to unexpected behavior, information disclosure, or potentially arbitrary code execution, impacting the integrity of the system.
7.1 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in libpng, a reference library for processing PNG (Portable Network Graphics) image files. A local attacker could exploit a heap buffer over-read vulnerability in the `png_image_finish_read` function by tricking a user into processing a specially crafted interlaced 16-bit PNG file with an 8-bit output format and non-minimal row stride. This could lead to a denial of service (DoS) and potentially information disclosure.
6.1 (Medium)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in libpng, a reference library for PNG (Portable Network Graphics) raster image files. An integer truncation vulnerability exists in the png_write_image_16bit and png_write_image_8bit simplified write API functions. A local attacker could exploit this flaw by providing a negative row stride (for bottom-up image layouts) or a stride exceeding 65535 bytes, leading to a heap buffer over-read. This can result in information disclosure or a denial of service (DoS) to the system.
6.6 (Medium)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A heap based buffer overflow flaw has been discovered in LibPNG. Prior to version 1.6.55, an out-of-bounds read vulnerability exists in the png_set_quantize() API function. When the function is called with no histogram and the number of colors in the palette is more than twice the maximum supported by the user's display, certain palettes will cause the function to enter into an infinite loop that reads past the end of an internal heap-allocated buffer. The images that trigger this vulnerability are valid per the PNG specification.
7.0 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in vLLM, an inference and serving engine for large language models (LLMs). Two model implementation files hardcode `trust_remote_code=True` when loading sub-components. This bypasses the user's explicit `--trust-remote-code=False` security opt-out, allowing a remote attacker to achieve remote code execution through malicious model repositories.
8.8 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A missing verification step has been discovered in PyJWT. PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC.
7.5 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
References
130 references
Acknowledgments
Elhanan Haenel
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat AI Inference Server Model Optimization Tools 3.3.1 (CUDA) is now available.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat\u00ae AI Inference Server Model Optimization Tools",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:8748",
"url": "https://access.redhat.com/errata/RHSA-2026:8748"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2023-40403",
"url": "https://access.redhat.com/security/cve/CVE-2023-40403"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2023-52356",
"url": "https://access.redhat.com/security/cve/CVE-2023-52356"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-13836",
"url": "https://access.redhat.com/security/cve/CVE-2025-13836"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-14831",
"url": "https://access.redhat.com/security/cve/CVE-2025-14831"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-15366",
"url": "https://access.redhat.com/security/cve/CVE-2025-15366"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-15367",
"url": "https://access.redhat.com/security/cve/CVE-2025-15367"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-0994",
"url": "https://access.redhat.com/security/cve/CVE-2026-0994"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-1299",
"url": "https://access.redhat.com/security/cve/CVE-2026-1299"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-22695",
"url": "https://access.redhat.com/security/cve/CVE-2026-22695"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-22801",
"url": "https://access.redhat.com/security/cve/CVE-2026-22801"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-2447",
"url": "https://access.redhat.com/security/cve/CVE-2026-2447"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-25646",
"url": "https://access.redhat.com/security/cve/CVE-2026-25646"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-27893",
"url": "https://access.redhat.com/security/cve/CVE-2026-27893"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32597",
"url": "https://access.redhat.com/security/cve/CVE-2026-32597"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-4111",
"url": "https://access.redhat.com/security/cve/CVE-2026-4111"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-4519",
"url": "https://access.redhat.com/security/cve/CVE-2026-4519"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://www.redhat.com/en/products/ai/inference-server",
"url": "https://www.redhat.com/en/products/ai/inference-server"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_8748.json"
}
],
"title": "Red Hat Security Advisory: Red Hat AI Inference Server Model Optimization Tools 3.3.1 (CUDA)",
"tracking": {
"current_release_date": "2026-08-08T16:34:46+00:00",
"generator": {
"date": "2026-08-08T16:34:46+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.12"
}
},
"id": "RHSA-2026:8748",
"initial_release_date": "2026-04-17T11:11:06+00:00",
"revision_history": [
{
"date": "2026-04-17T11:11:06+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-08-08T04:36:23+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-08T16:34:46+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat AI Inference Server 3.3",
"product": {
"name": "Red Hat AI Inference Server 3.3",
"product_id": "Red Hat AI Inference Server 3.3",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:ai_inference_server:3.3::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat AI Inference Server"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64",
"product": {
"name": "registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64",
"product_id": "registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64",
"product_identification_helper": {
"purl": "pkg:oci/model-opt-cuda-rhel9@sha256%3Ad8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc?arch=amd64\u0026repository_url=registry.redhat.io/rhaiis\u0026tag=1775749857"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64",
"product": {
"name": "registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64",
"product_id": "registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64",
"product_identification_helper": {
"purl": "pkg:oci/model-opt-cuda-rhel9@sha256%3Abe6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e?arch=arm64\u0026repository_url=registry.redhat.io/rhaiis\u0026tag=1775749857"
}
}
}
],
"category": "architecture",
"name": "arm64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64 as a component of Red Hat AI Inference Server 3.3",
"product_id": "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64"
},
"product_reference": "registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64",
"relates_to_product_reference": "Red Hat AI Inference Server 3.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64 as a component of Red Hat AI Inference Server 3.3",
"product_id": "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64"
},
"product_reference": "registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64",
"relates_to_product_reference": "Red Hat AI Inference Server 3.3"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2023-40403",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2025-03-04T12:01:50.826520+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2349766"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libxslt package. Processing web content may disclose sensitive information. This issue was addressed with improved memory handling.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxslt: Processing web content may disclose sensitive information",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This CVE is a duplicate of CVE-2022-4909.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2023-40403"
},
{
"category": "external",
"summary": "RHBZ#2349766",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2349766"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2023-40403",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-40403"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-40403",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40403"
},
{
"category": "external",
"summary": "http://seclists.org/fulldisclosure/2023/Oct/10",
"url": "http://seclists.org/fulldisclosure/2023/Oct/10"
},
{
"category": "external",
"summary": "http://seclists.org/fulldisclosure/2023/Oct/3",
"url": "http://seclists.org/fulldisclosure/2023/Oct/3"
},
{
"category": "external",
"summary": "http://seclists.org/fulldisclosure/2023/Oct/4",
"url": "http://seclists.org/fulldisclosure/2023/Oct/4"
},
{
"category": "external",
"summary": "http://seclists.org/fulldisclosure/2023/Oct/5",
"url": "http://seclists.org/fulldisclosure/2023/Oct/5"
},
{
"category": "external",
"summary": "http://seclists.org/fulldisclosure/2023/Oct/6",
"url": "http://seclists.org/fulldisclosure/2023/Oct/6"
},
{
"category": "external",
"summary": "http://seclists.org/fulldisclosure/2023/Oct/8",
"url": "http://seclists.org/fulldisclosure/2023/Oct/8"
},
{
"category": "external",
"summary": "http://seclists.org/fulldisclosure/2023/Oct/9",
"url": "http://seclists.org/fulldisclosure/2023/Oct/9"
},
{
"category": "external",
"summary": "https://bugs.chromium.org/p/chromium/issues/detail?id=1356211",
"url": "https://bugs.chromium.org/p/chromium/issues/detail?id=1356211"
},
{
"category": "external",
"summary": "https://bugzilla.gnome.org/show_bug.cgi?id=751621",
"url": "https://bugzilla.gnome.org/show_bug.cgi?id=751621"
},
{
"category": "external",
"summary": "https://gitlab.gnome.org/GNOME/libxslt/-/issues/94",
"url": "https://gitlab.gnome.org/GNOME/libxslt/-/issues/94"
},
{
"category": "external",
"summary": "https://support.apple.com/en-us/HT213927",
"url": "https://support.apple.com/en-us/HT213927"
}
],
"release_date": "2023-09-26T20:14:54.697000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-17T11:11:06+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:8748",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8748"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libxslt: Processing web content may disclose sensitive information"
},
{
"cve": "CVE-2023-52356",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2023-11-24T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2251344"
}
],
"notes": [
{
"category": "description",
"text": "A segment fault (SEGV) flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFReadRGBATileExt() API. This flaw allows a remote attacker to cause a heap-buffer overflow, leading to a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libtiff: Segment fault in libtiff in TIFFReadRGBATileExt() leading to denial of service",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The flaw allows an attacker to potentially cause a denial of service attack by crashing a program, but the impact is minimal.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2023-52356"
},
{
"category": "external",
"summary": "RHBZ#2251344",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2251344"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2023-52356",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-52356"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-52356",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-52356"
},
{
"category": "external",
"summary": "https://gitlab.com/libtiff/libtiff/-/issues/622",
"url": "https://gitlab.com/libtiff/libtiff/-/issues/622"
},
{
"category": "external",
"summary": "https://gitlab.com/libtiff/libtiff/-/merge_requests/546",
"url": "https://gitlab.com/libtiff/libtiff/-/merge_requests/546"
}
],
"release_date": "2023-11-03T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-17T11:11:06+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:8748",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8748"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libtiff: Segment fault in libtiff in TIFFReadRGBATileExt() leading to denial of service"
},
{
"cve": "CVE-2025-13836",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2025-12-01T19:01:03.091899+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2418078"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the http.client module in the Python standard library. When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This issue allows a malicious server to cause the client to read large amounts of data into memory, potentially causing memory allocations errors, swapping, out-of-memory conditions or even system freezes.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "cpython: Excessive read buffering DoS in http.client",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue can only be exploited by Python applications using the http.client.HTTPResponse.read function without the amount parameter, which specifies the read size in bytes. Note that Python libraries may use this function internally and make applications vulnerable. Additionally, vulnerable Python applications must connect to a malicious or compromised server that replies with a very large or crafted Content-Length header to trigger this issue, limiting the exposure of this vulnerability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-13836"
},
{
"category": "external",
"summary": "RHBZ#2418078",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418078"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-13836",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-13836"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-13836",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13836"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/issues/119451",
"url": "https://github.com/python/cpython/issues/119451"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/pull/119454",
"url": "https://github.com/python/cpython/pull/119454"
}
],
"release_date": "2025-12-01T18:02:38.483000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-17T11:11:06+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:8748",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8748"
},
{
"category": "workaround",
"details": "Since this vulnerability is triggered when no read amount is specified and the client defaults to using the potentially malicious Content-Length header, developers can mitigate this issue in their code by always imposing an explicit, safe limit on data reads.\n\nApplications using the http.client.HTTPResponse.read function directly can ensure that read operations specify a byte limit:\n\n~~~\n...\nmax_safe_read = 10 * 1024 * 1024\ndata = response.read(max_safe_read)\n...\n~~~",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "cpython: Excessive read buffering DoS in http.client"
},
{
"cve": "CVE-2025-14831",
"cwe": {
"id": "CWE-407",
"name": "Inefficient Algorithmic Complexity"
},
"discovery_date": "2025-12-17T14:48:30.222000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2423177"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in GnuTLS. This vulnerability allows a denial of service (DoS) by excessive CPU (Central Processing Unit) and memory consumption via specially crafted malicious certificates containing a large number of name constraints and subject alternative names (SANs).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "gnutls: GnuTLS: Denial of Service via excessive resource consumption during certificate verification",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Moderate for Red Hat. GnuTLS is susceptible to a denial of service attack due to excessive CPU and memory consumption. This occurs when processing specially crafted malicious certificates containing a large number of name constraints and subject alternative names (SANs) during certificate verification.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-14831"
},
{
"category": "external",
"summary": "RHBZ#2423177",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2423177"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-14831",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-14831"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-14831",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14831"
},
{
"category": "external",
"summary": "https://gitlab.com/gnutls/gnutls/-/issues/1773",
"url": "https://gitlab.com/gnutls/gnutls/-/issues/1773"
}
],
"release_date": "2026-02-09T14:26:34.939000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-17T11:11:06+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:8748",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8748"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "gnutls: GnuTLS: Denial of Service via excessive resource consumption during certificate verification"
},
{
"cve": "CVE-2025-15366",
"cwe": {
"id": "CWE-77",
"name": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)"
},
"discovery_date": "2026-01-20T22:01:33.257688+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2431368"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the imaplib module in the Python standard library. The imaplib module does not reject control characters, such as newlines, in user-controlled input passed to IMAP commands. This issue allows an attacker to inject additional commands to be executed in the IMAP server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "cpython: IMAP command injection in user-controlled commands",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to have the privileges required to send malicious input to an application that sends IMAP commands to a server. Additionally, this flaw can allow attackers to manipulate the state of the mailbox (e.g., delete emails, move folders, flag messages) and to potentially read metadata or specific email content, but it does not allow arbitrary code execution or OS command injection. Due to these reasons, this issue has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-15366"
},
{
"category": "external",
"summary": "RHBZ#2431368",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431368"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-15366",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-15366"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-15366",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15366"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/issues/143921",
"url": "https://github.com/python/cpython/issues/143921"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/pull/143922",
"url": "https://github.com/python/cpython/pull/143922"
},
{
"category": "external",
"summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/DD7C7JZJYTBXMDOWKCEIEBJLBRU64OMR/",
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/DD7C7JZJYTBXMDOWKCEIEBJLBRU64OMR/"
}
],
"release_date": "2026-01-20T21:40:24.938000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-17T11:11:06+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:8748",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8748"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, ensure that no data passed to the imaplib module contains newline or carriage return characters.",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "cpython: IMAP command injection in user-controlled commands"
},
{
"cve": "CVE-2025-15367",
"cwe": {
"id": "CWE-77",
"name": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)"
},
"discovery_date": "2026-01-20T22:02:09.399038+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2431373"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the poplib module in the Python standard library. The poplib module does not reject control characters, such as newlines, in user-controlled input passed to POP3 commands. This issue allows an attacker to inject additional commands to be executed in the POP3 server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "cpython: POP3 command injection in user-controlled commands",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to have the privileges required to send malicious input to an application that sends POP3 commands to a server. Additionally, this flaw can allow attackers to manipulate the state of the mailbox (e.g., delete emails) and to potentially read metadata or specific email content, but it does not allow arbitrary code execution or OS command injection. Due to these reasons, this issue has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-15367"
},
{
"category": "external",
"summary": "RHBZ#2431373",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431373"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-15367",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-15367"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-15367",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15367"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/issues/143923",
"url": "https://github.com/python/cpython/issues/143923"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/pull/143924",
"url": "https://github.com/python/cpython/pull/143924"
},
{
"category": "external",
"summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/CBFBOWVGGUJFSGITQCCBZS4GEYYZ7ZNE/",
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/CBFBOWVGGUJFSGITQCCBZS4GEYYZ7ZNE/"
}
],
"release_date": "2026-01-20T21:47:09.885000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-17T11:11:06+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:8748",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8748"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, ensure that no data passed to the poplib module contains newline or carriage return characters.",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "cpython: POP3 command injection in user-controlled commands"
},
{
"cve": "CVE-2026-0994",
"cwe": {
"id": "CWE-674",
"name": "Uncontrolled Recursion"
},
"discovery_date": "2026-01-23T16:02:59.235878+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2432398"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in protobuf. A remote attacker can exploit this denial-of-service (DoS) vulnerability by supplying deeply nested `google.protobuf.Any` messages to the `google.protobuf.json_format.ParseDict()` function. This bypasses the intended recursion depth limit, leading to the exhaustion of Python\u2019s recursion stack and causing a `RecursionError`, which results in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python: protobuf: Protobuf: Denial of Service due to recursion depth bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Important for Red Hat products. The flaw in `protobuf` allows a remote attacker to trigger a denial-of-service by providing specially crafted, deeply nested `google.protobuf.Any` messages to the `google.protobuf.json_format.ParseDict()` function. This bypasses the intended recursion depth limit, leading to resource exhaustion and application crashes.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-0994"
},
{
"category": "external",
"summary": "RHBZ#2432398",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2432398"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-0994",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0994"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-0994",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0994"
},
{
"category": "external",
"summary": "https://github.com/protocolbuffers/protobuf/pull/25239",
"url": "https://github.com/protocolbuffers/protobuf/pull/25239"
}
],
"release_date": "2026-01-23T14:55:16.876000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-17T11:11:06+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:8748",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8748"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "python: protobuf: Protobuf: Denial of Service due to recursion depth bypass"
},
{
"cve": "CVE-2026-1299",
"cwe": {
"id": "CWE-93",
"name": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)"
},
"discovery_date": "2026-01-23T17:02:57.343486+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2432437"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the email module in the Python standard library. When serializing an email message, the BytesGenerator class fails to properly quote newline characters for email headers. This issue is exploitable when the LiteralHeader class is used as it does not respect email folding rules, allowing an attacker to inject email headers and potentially modify message recipients or the email body, and spoof sender information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "cpython: email header injection due to unquoted newlines",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue can only be exploitable by Python applications using the LiteralHeader class to write email headers, as it does not respect email folding rules. Additionally, this issue allows attackers to modify message recipients or the email body and spoof sender identity but it does not cause memory corruption or arbitrary code execution. Due to these reasons, this vulnerability has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-1299"
},
{
"category": "external",
"summary": "RHBZ#2432437",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2432437"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-1299",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-1299"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-1299",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1299"
},
{
"category": "external",
"summary": "https://cve.org/CVERecord?id=CVE-2024-6923",
"url": "https://cve.org/CVERecord?id=CVE-2024-6923"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/commit/052e55e7d44718fe46cbba0ca995cb8fcc359413",
"url": "https://github.com/python/cpython/commit/052e55e7d44718fe46cbba0ca995cb8fcc359413"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/issues/144125",
"url": "https://github.com/python/cpython/issues/144125"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/pull/144126",
"url": "https://github.com/python/cpython/pull/144126"
},
{
"category": "external",
"summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/6ZZULGALJTITEAGEXLDJE2C6FORDXPBT/",
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/6ZZULGALJTITEAGEXLDJE2C6FORDXPBT/"
}
],
"release_date": "2026-01-23T16:27:13.346000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-17T11:11:06+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:8748",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8748"
},
{
"category": "workaround",
"details": "To mitigate this issue, applications accepting user-supplied data for email headers should sanitize the input by stripping or rejecting any strings containing carriage return or line feed characters, \u0027\\r\u0027 or \u0027\\n\u0027, respectively, preventing malicious sequences that could lead to header manipulation.",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "cpython: email header injection due to unquoted newlines"
},
{
"cve": "CVE-2026-2447",
"discovery_date": "2026-02-16T15:01:25.122593+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2440219"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Firefox and Thunderbird. The Mozilla Foundation\u0027s Security Advisory describes the following issue: Heap buffer overflow in libvpx.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libvpx: Heap buffer overflow in libvpx",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-2447"
},
{
"category": "external",
"summary": "RHBZ#2440219",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2440219"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-2447",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2447"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-2447",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2447"
},
{
"category": "external",
"summary": "https://bugzilla.mozilla.org/show_bug.cgi?id=2014390",
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=2014390"
},
{
"category": "external",
"summary": "https://www.mozilla.org/security/advisories/mfsa2026-10/",
"url": "https://www.mozilla.org/security/advisories/mfsa2026-10/"
}
],
"release_date": "2026-02-16T14:13:23.559000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-17T11:11:06+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:8748",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8748"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "libvpx: Heap buffer overflow in libvpx"
},
{
"acknowledgments": [
{
"names": [
"Elhanan Haenel"
]
}
],
"cve": "CVE-2026-4111",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
},
"discovery_date": "2026-03-11T11:18:51.609000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2446453"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically within the archive_read_data() processing path. When a specially crafted RAR5 archive is processed, the decompression routine may enter a state where internal logic prevents forward progress. This condition results in an infinite loop that continuously consumes CPU resources. Because the archive passes checksum validation and appears structurally valid, affected applications cannot detect the issue before processing. This can allow attackers to cause persistent denial-of-service conditions in services that automatically process archives.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libarchive: Infinite Loop Denial of Service in RAR5 Decompression via archive_read_data() in libarchive",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Red Hat Product Security team would likely assess the severity of this vulnerability as High because it allows remote attackers to cause a persistent denial-of-service condition using a small crafted archive file. Successful exploitation requires no authentication, no special configuration, and no user interaction in environments that automatically process uploaded archives. By repeatedly submitting malicious archives, an attacker can exhaust CPU resources or worker threads in services such as file upload systems, CI/CD pipelines, mail scanners, and content indexing services that rely on libarchive for archive extraction.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4111"
},
{
"category": "external",
"summary": "RHBZ#2446453",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2446453"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4111",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4111"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4111",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4111"
},
{
"category": "external",
"summary": "https://github.com/libarchive/libarchive/pull/2877",
"url": "https://github.com/libarchive/libarchive/pull/2877"
}
],
"release_date": "2026-03-11T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-17T11:11:06+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:8748",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8748"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "libarchive: Infinite Loop Denial of Service in RAR5 Decompression via archive_read_data() in libarchive"
},
{
"cve": "CVE-2026-4519",
"cwe": {
"id": "CWE-88",
"name": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)"
},
"discovery_date": "2026-03-20T16:02:13.494105+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2449649"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Python. The `webbrowser.open()` API, used to launch web browsers, does not properly sanitize input. This allows a remote attacker to craft a malicious URL containing leading dashes. When such a URL is opened, certain web browsers may interpret these dashes as command-line options, which could lead to unexpected behavior, information disclosure, or potentially arbitrary code execution, impacting the integrity of the system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python: Python: Command-line option injection in webbrowser.open() via crafted URLs",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4519"
},
{
"category": "external",
"summary": "RHBZ#2449649",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449649"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4519",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4519"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4519",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4519"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/issues/143930",
"url": "https://github.com/python/cpython/issues/143930"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/pull/143931",
"url": "https://github.com/python/cpython/pull/143931"
},
{
"category": "external",
"summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/AY5NDSS433JK56Q7Q5IS7B37QFZVVOUS/",
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/AY5NDSS433JK56Q7Q5IS7B37QFZVVOUS/"
}
],
"release_date": "2026-03-20T15:08:32.576000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-17T11:11:06+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:8748",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8748"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"products": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "python: Python: Command-line option injection in webbrowser.open() via crafted URLs"
},
{
"cve": "CVE-2026-22695",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2026-01-13T00:08:52.403246+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2428825"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libpng, a reference library for processing PNG (Portable Network Graphics) image files. A local attacker could exploit a heap buffer over-read vulnerability in the `png_image_finish_read` function by tricking a user into processing a specially crafted interlaced 16-bit PNG file with an 8-bit output format and non-minimal row stride. This could lead to a denial of service (DoS) and potentially information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libpng: libpng: Denial of service and information disclosure via heap buffer over-read in png_image_finish_read",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Moderate for Red Hat products. A heap buffer over-read flaw exists in the libpng library when processing specially crafted interlaced 16-bit PNG images with 8-bit output format and non-minimal row stride. This issue requires user interaction, as an attacker would need to trick a user into opening a malicious PNG file.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-22695"
},
{
"category": "external",
"summary": "RHBZ#2428825",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2428825"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-22695",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-22695"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-22695",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22695"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/commit/218612ddd6b17944e21eda56caf8b4bf7779d1ea",
"url": "https://github.com/pnggroup/libpng/commit/218612ddd6b17944e21eda56caf8b4bf7779d1ea"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/commit/e4f7ad4ea2",
"url": "https://github.com/pnggroup/libpng/commit/e4f7ad4ea2"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/issues/778",
"url": "https://github.com/pnggroup/libpng/issues/778"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/security/advisories/GHSA-mmq5-27w3-rxpp",
"url": "https://github.com/pnggroup/libpng/security/advisories/GHSA-mmq5-27w3-rxpp"
}
],
"release_date": "2026-01-12T22:55:40.204000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-17T11:11:06+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:8748",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8748"
},
{
"category": "workaround",
"details": "To mitigate this issue, users should avoid opening untrusted PNG image files. Applications that process PNG images should be configured to restrict processing of untrusted or unverified content where possible.",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libpng: libpng: Denial of service and information disclosure via heap buffer over-read in png_image_finish_read"
},
{
"cve": "CVE-2026-22801",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2026-01-13T00:08:42.581146+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2428824"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libpng, a reference library for PNG (Portable Network Graphics) raster image files. An integer truncation vulnerability exists in the png_write_image_16bit and png_write_image_8bit simplified write API functions. A local attacker could exploit this flaw by providing a negative row stride (for bottom-up image layouts) or a stride exceeding 65535 bytes, leading to a heap buffer over-read. This can result in information disclosure or a denial of service (DoS) to the system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libpng: libpng: Information disclosure and denial of service via integer truncation in simplified write API",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Moderate for Red Hat products. An integer truncation flaw in the libpng simplified write API functions (`png_write_image_16bit`, `png_write_image_8bit`) can lead to a heap buffer over-read. Exploitation requires an application to process specially crafted input that provides a negative row stride or a stride exceeding 65535 bytes, potentially resulting in denial of service or information disclosure.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-22801"
},
{
"category": "external",
"summary": "RHBZ#2428824",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2428824"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-22801",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-22801"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-22801",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22801"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/security/advisories/GHSA-vgjq-8cw5-ggw8",
"url": "https://github.com/pnggroup/libpng/security/advisories/GHSA-vgjq-8cw5-ggw8"
}
],
"release_date": "2026-01-12T22:57:58.288000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-17T11:11:06+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:8748",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8748"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"products": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libpng: libpng: Information disclosure and denial of service via integer truncation in simplified write API"
},
{
"cve": "CVE-2026-25646",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2026-02-10T18:01:28.232408+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2438542"
}
],
"notes": [
{
"category": "description",
"text": "A heap based buffer overflow flaw has been discovered in LibPNG. Prior to version 1.6.55, an out-of-bounds read vulnerability exists in the png_set_quantize() API function. When the function is called with no histogram and the number of colors in the palette is more than twice the maximum supported by the user\u0027s display, certain palettes will cause the function to enter into an infinite loop that reads past the end of an internal heap-allocated buffer. The images that trigger this vulnerability are valid per the PNG specification.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libpng: LIBPNG has a heap buffer overflow in png_set_quantize",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-25646"
},
{
"category": "external",
"summary": "RHBZ#2438542",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2438542"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-25646",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25646"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25646",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25646"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/02/09/7",
"url": "http://www.openwall.com/lists/oss-security/2026/02/09/7"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/commit/01d03b8453eb30ade759cd45c707e5a1c7277d88",
"url": "https://github.com/pnggroup/libpng/commit/01d03b8453eb30ade759cd45c707e5a1c7277d88"
},
{
"category": "external",
"summary": "https://github.com/pnggroup/libpng/security/advisories/GHSA-g8hp-mq4h-rqm3",
"url": "https://github.com/pnggroup/libpng/security/advisories/GHSA-g8hp-mq4h-rqm3"
}
],
"release_date": "2026-02-10T17:04:38.501000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-17T11:11:06+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:8748",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8748"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"products": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "libpng: LIBPNG has a heap buffer overflow in png_set_quantize"
},
{
"cve": "CVE-2026-27893",
"cwe": {
"id": "CWE-501",
"name": "Trust Boundary Violation"
},
"discovery_date": "2026-03-27T00:01:43.935417+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2452055"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in vLLM, an inference and serving engine for large language models (LLMs). Two model implementation files hardcode `trust_remote_code=True` when loading sub-components. This bypasses the user\u0027s explicit `--trust-remote-code=False` security opt-out, allowing a remote attacker to achieve remote code execution through malicious model repositories.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "vllm: vLLM: Remote code execution due to hardcoded trust_remote_code setting",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important vulnerability in vLLM, as shipped in Red Hat AI Inference Server and Red Hat OpenShift AI. The flaw allows remote code execution due to vLLM hardcoding `trust_remote_code=True` when loading sub-components, which bypasses the user\u0027s explicit `--trust-remote-code=False` security opt-out. This can lead to exploitation through malicious model repositories.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27893"
},
{
"category": "external",
"summary": "RHBZ#2452055",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2452055"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27893",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27893"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27893",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27893"
},
{
"category": "external",
"summary": "https://github.com/vllm-project/vllm/commit/00bd08edeee5dd4d4c13277c0114a464011acf72",
"url": "https://github.com/vllm-project/vllm/commit/00bd08edeee5dd4d4c13277c0114a464011acf72"
},
{
"category": "external",
"summary": "https://github.com/vllm-project/vllm/pull/36192",
"url": "https://github.com/vllm-project/vllm/pull/36192"
},
{
"category": "external",
"summary": "https://github.com/vllm-project/vllm/security/advisories/GHSA-7972-pg2x-xr59",
"url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-7972-pg2x-xr59"
}
],
"release_date": "2026-03-26T23:56:53.579000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-17T11:11:06+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:8748",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8748"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "vllm: vLLM: Remote code execution due to hardcoded trust_remote_code setting"
},
{
"cve": "CVE-2026-32597",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-03-12T22:01:29.967713+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2447194"
}
],
"notes": [
{
"category": "description",
"text": "A missing verification step has been discovered in PyJWT. PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 \u00a74.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 \u00a74.1.11 MUST violation)",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32597"
},
{
"category": "external",
"summary": "RHBZ#2447194",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447194"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32597",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32597"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32597",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32597"
},
{
"category": "external",
"summary": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-752w-5fwx-jx9f",
"url": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-752w-5fwx-jx9f"
}
],
"release_date": "2026-03-12T21:41:50.427000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-17T11:11:06+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:8748",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8748"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:be6d568f28044533e4ad80f0856407c359e2eaf31a6b89cada433e6575d2300e_arm64",
"Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:d8ab90372d2d7968442a6dfa4f6ad04939e47f9b1299107d4a26565db25712bc_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 \u00a74.1.11 MUST violation)"
}
]
}
rlsa-2026:19138
Vulnerability from osv_rocky
Published
2026-05-29 16:03
Modified
2026-06-12 12:06
Summary
Important: fence-agents security update
Details
The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster.
Security Fix(es):
-
pyjwt: PyJWT accepts unknown
critheader extensions (RFC 7515 ?4.1.11 MUST violation) (CVE-2026-32597) -
pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion (CVE-2026-30922)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Severity
7.5 (High)
Credits
Rocky Enterprise Software Foundation
Red Hat
References
{
"affected": [
{
"package": {
"ecosystem": "Rocky Linux:10",
"name": "fence-agents",
"purl": "pkg:rpm/rocky-linux/fence-agents?distro=rocky-linux-10\u0026epoch=0"
},
"ranges": [
{
"database_specific": {
"yum_repository": "AppStream"
},
"events": [
{
"introduced": "0"
},
{
"fixed": "0:4.16.0-21.el10_2.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"credits": [
{
"name": "Rocky Enterprise Software Foundation"
},
{
"name": "Red Hat"
}
],
"details": "The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. \n\nSecurity Fix(es):\n\n* pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 ?4.1.11 MUST violation) (CVE-2026-32597)\n\n* pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion (CVE-2026-30922)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"id": "RLSA-2026:19138",
"modified": "2026-06-12T12:06:13.470629Z",
"published": "2026-05-29T16:03:24.060458Z",
"references": [
{
"type": "ADVISORY",
"url": "https://errata.rockylinux.org/RLSA-2026:19138"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448553"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447194"
}
],
"schema_version": "1.7.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Important: fence-agents security update",
"upstream": [
"CVE-2026-30922",
"CVE-2026-32597"
]
}
rlsa-2026:19355
Vulnerability from osv_rocky
Published
2026-05-30 18:03
Modified
2026-06-13 18:05
Summary
Important: fence-agents security update
Details
The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster.
Security Fix(es):
-
cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves (CVE-2026-26007)
-
pyjwt: PyJWT accepts unknown
critheader extensions (RFC 7515 ?4.1.11 MUST violation) (CVE-2026-32597) -
pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion (CVE-2026-30922)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Severity
7.5 (High)
Credits
Rocky Enterprise Software Foundation
Red Hat
References
{
"affected": [
{
"package": {
"ecosystem": "Rocky Linux:9",
"name": "fence-agents",
"purl": "pkg:rpm/rocky-linux/fence-agents?distro=rocky-linux-9\u0026epoch=0"
},
"ranges": [
{
"database_specific": {
"yum_repository": "AppStream"
},
"events": [
{
"introduced": "0"
},
{
"fixed": "0:4.10.0-110.el9_8.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"credits": [
{
"name": "Rocky Enterprise Software Foundation"
},
{
"name": "Red Hat"
}
],
"details": "The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. \n\nSecurity Fix(es):\n\n* cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves (CVE-2026-26007)\n\n* pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 ?4.1.11 MUST violation) (CVE-2026-32597)\n\n* pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion (CVE-2026-30922)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"id": "RLSA-2026:19355",
"modified": "2026-06-13T18:05:48.427037Z",
"published": "2026-05-30T18:03:01.190443Z",
"references": [
{
"type": "ADVISORY",
"url": "https://errata.rockylinux.org/RLSA-2026:19355"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2438762"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447194"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448553"
}
],
"schema_version": "1.7.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Important: fence-agents security update",
"upstream": [
"CVE-2026-26007",
"CVE-2026-30922",
"CVE-2026-32597"
]
}
SUSE-SU-2026:1199-1
Vulnerability from csaf_suse - Published: 2026-04-07 10:25 - Updated: 2026-04-07 10:25Summary
Security update for python-PyJWT
Severity
Important
Notes
Title of the patch: Security update for python-PyJWT
Description of the patch: This update for python-PyJWT fixes the following issues:
- CVE-2026-32597: Fixed unknown `crit` header extensions accepts (bsc#1259616).
Patchnames: SUSE-2026-1199,SUSE-SLE-Module-Public-Cloud-12-2026-1199
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
7.5 (High)
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Module for Public Cloud 12:python-PyJWT-1.5.3-3.19.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Public Cloud 12:python3-PyJWT-1.5.3-3.19.1.noarch | — |
Vendor Fix
|
Threats
Impact
important
References
8 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for python-PyJWT",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for python-PyJWT fixes the following issues:\n\n- CVE-2026-32597: Fixed unknown `crit` header extensions accepts (bsc#1259616).\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-2026-1199,SUSE-SLE-Module-Public-Cloud-12-2026-1199",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_1199-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2026:1199-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-20261199-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2026:1199-1",
"url": "https://lists.suse.com/pipermail/sle-updates/2026-April/045291.html"
},
{
"category": "self",
"summary": "SUSE Bug 1259616",
"url": "https://bugzilla.suse.com/1259616"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-32597 page",
"url": "https://www.suse.com/security/cve/CVE-2026-32597/"
}
],
"title": "Security update for python-PyJWT",
"tracking": {
"current_release_date": "2026-04-07T10:25:37Z",
"generator": {
"date": "2026-04-07T10:25:37Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2026:1199-1",
"initial_release_date": "2026-04-07T10:25:37Z",
"revision_history": [
{
"date": "2026-04-07T10:25:37Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "python-PyJWT-1.5.3-3.19.1.noarch",
"product": {
"name": "python-PyJWT-1.5.3-3.19.1.noarch",
"product_id": "python-PyJWT-1.5.3-3.19.1.noarch"
}
},
{
"category": "product_version",
"name": "python3-PyJWT-1.5.3-3.19.1.noarch",
"product": {
"name": "python3-PyJWT-1.5.3-3.19.1.noarch",
"product_id": "python3-PyJWT-1.5.3-3.19.1.noarch"
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Module for Public Cloud 12",
"product": {
"name": "SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Module for Public Cloud 12",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle-module-public-cloud:12"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "python-PyJWT-1.5.3-3.19.1.noarch as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Module for Public Cloud 12:python-PyJWT-1.5.3-3.19.1.noarch"
},
"product_reference": "python-PyJWT-1.5.3-3.19.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Public Cloud 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-PyJWT-1.5.3-3.19.1.noarch as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Module for Public Cloud 12:python3-PyJWT-1.5.3-3.19.1.noarch"
},
"product_reference": "python3-PyJWT-1.5.3-3.19.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Public Cloud 12"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-32597",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-32597"
}
],
"notes": [
{
"category": "general",
"text": "PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC. This vulnerability is fixed in 2.12.0.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Public Cloud 12:python-PyJWT-1.5.3-3.19.1.noarch",
"SUSE Linux Enterprise Module for Public Cloud 12:python3-PyJWT-1.5.3-3.19.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-32597",
"url": "https://www.suse.com/security/cve/CVE-2026-32597"
},
{
"category": "external",
"summary": "SUSE Bug 1259616 for CVE-2026-32597",
"url": "https://bugzilla.suse.com/1259616"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Public Cloud 12:python-PyJWT-1.5.3-3.19.1.noarch",
"SUSE Linux Enterprise Module for Public Cloud 12:python3-PyJWT-1.5.3-3.19.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Public Cloud 12:python-PyJWT-1.5.3-3.19.1.noarch",
"SUSE Linux Enterprise Module for Public Cloud 12:python3-PyJWT-1.5.3-3.19.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-04-07T10:25:37Z",
"details": "important"
}
],
"title": "CVE-2026-32597"
}
]
}
SUSE-SU-2026:1389-1
Vulnerability from csaf_suse - Published: 2026-04-16 09:19 - Updated: 2026-04-16 09:19Summary
Security update for python-PyJWT
Severity
Important
Notes
Title of the patch: Security update for python-PyJWT
Description of the patch: This update for python-PyJWT fixes the following issues:
- CVE-2026-32597: Fixed unknown `crit` header extensions accepts (bsc#1259616).
Patchnames: SUSE-2026-1389,SUSE-SLE-Module-Public-Cloud-15-SP4-2026-1389,SUSE-SLE-Module-Python3-15-SP7-2026-1389,SUSE-SLE-Product-HPC-15-SP4-ESPOS-2026-1389,SUSE-SLE-Product-HPC-15-SP4-LTSS-2026-1389,SUSE-SLE-Product-HPC-15-SP5-ESPOS-2026-1389,SUSE-SLE-Product-HPC-15-SP5-LTSS-2026-1389,SUSE-SLE-Product-SLES-15-SP4-LTSS-2026-1389,SUSE-SLE-Product-SLES-15-SP5-LTSS-2026-1389,SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-1389,SUSE-SLE-Product-SLES_SAP-15-SP4-2026-1389,SUSE-SLE-Product-SLES_SAP-15-SP5-2026-1389,SUSE-SLE-Product-SLES_SAP-15-SP6-2026-1389,openSUSE-SLE-15.6-2026-1389
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
7.5 (High)
Affected products
Recommended
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:python311-PyJWT-2.8.0-150400.8.10.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:python311-PyJWT-2.8.0-150400.8.10.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:python311-PyJWT-2.8.0-150400.8.10.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:python311-PyJWT-2.8.0-150400.8.10.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Public Cloud 15 SP4:python311-PyJWT-2.8.0-150400.8.10.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Python 3 15 SP7:python311-PyJWT-2.8.0-150400.8.10.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP4-LTSS:python311-PyJWT-2.8.0-150400.8.10.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP5-LTSS:python311-PyJWT-2.8.0-150400.8.10.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server 15 SP6-LTSS:python311-PyJWT-2.8.0-150400.8.10.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP4:python311-PyJWT-2.8.0-150400.8.10.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP5:python311-PyJWT-2.8.0-150400.8.10.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 15 SP6:python311-PyJWT-2.8.0-150400.8.10.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:python311-PyJWT-2.8.0-150400.8.10.1.noarch | — |
Vendor Fix
|
Threats
Impact
important
References
8 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for python-PyJWT",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for python-PyJWT fixes the following issues:\n\n- CVE-2026-32597: Fixed unknown `crit` header extensions accepts (bsc#1259616).\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-2026-1389,SUSE-SLE-Module-Public-Cloud-15-SP4-2026-1389,SUSE-SLE-Module-Python3-15-SP7-2026-1389,SUSE-SLE-Product-HPC-15-SP4-ESPOS-2026-1389,SUSE-SLE-Product-HPC-15-SP4-LTSS-2026-1389,SUSE-SLE-Product-HPC-15-SP5-ESPOS-2026-1389,SUSE-SLE-Product-HPC-15-SP5-LTSS-2026-1389,SUSE-SLE-Product-SLES-15-SP4-LTSS-2026-1389,SUSE-SLE-Product-SLES-15-SP5-LTSS-2026-1389,SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-1389,SUSE-SLE-Product-SLES_SAP-15-SP4-2026-1389,SUSE-SLE-Product-SLES_SAP-15-SP5-2026-1389,SUSE-SLE-Product-SLES_SAP-15-SP6-2026-1389,openSUSE-SLE-15.6-2026-1389",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_1389-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2026:1389-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-20261389-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2026:1389-1",
"url": "https://lists.suse.com/pipermail/sle-updates/2026-April/045612.html"
},
{
"category": "self",
"summary": "SUSE Bug 1259616",
"url": "https://bugzilla.suse.com/1259616"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-32597 page",
"url": "https://www.suse.com/security/cve/CVE-2026-32597/"
}
],
"title": "Security update for python-PyJWT",
"tracking": {
"current_release_date": "2026-04-16T09:19:26Z",
"generator": {
"date": "2026-04-16T09:19:26Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2026:1389-1",
"initial_release_date": "2026-04-16T09:19:26Z",
"revision_history": [
{
"date": "2026-04-16T09:19:26Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "python311-PyJWT-2.8.0-150400.8.10.1.noarch",
"product": {
"name": "python311-PyJWT-2.8.0-150400.8.10.1.noarch",
"product_id": "python311-PyJWT-2.8.0-150400.8.10.1.noarch"
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Module for Public Cloud 15 SP4",
"product": {
"name": "SUSE Linux Enterprise Module for Public Cloud 15 SP4",
"product_id": "SUSE Linux Enterprise Module for Public Cloud 15 SP4",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle-module-public-cloud:15:sp4"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Module for Python 3 15 SP7",
"product": {
"name": "SUSE Linux Enterprise Module for Python 3 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Python 3 15 SP7",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle-module-python3:15:sp7"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS",
"product": {
"name": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle_hpc-espos:15:sp4"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
"product": {
"name": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle_hpc-ltss:15:sp4"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS",
"product": {
"name": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle_hpc-espos:15:sp5"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
"product": {
"name": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle_hpc-ltss:15:sp5"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 15 SP4-LTSS",
"product": {
"name": "SUSE Linux Enterprise Server 15 SP4-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP4-LTSS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles-ltss:15:sp4"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 15 SP5-LTSS",
"product": {
"name": "SUSE Linux Enterprise Server 15 SP5-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP5-LTSS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles-ltss:15:sp5"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 15 SP6-LTSS",
"product": {
"name": "SUSE Linux Enterprise Server 15 SP6-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles-ltss:15:sp6"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP Applications 15 SP4",
"product": {
"name": "SUSE Linux Enterprise Server for SAP Applications 15 SP4",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP4",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles_sap:15:sp4"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP Applications 15 SP5",
"product": {
"name": "SUSE Linux Enterprise Server for SAP Applications 15 SP5",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP5",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles_sap:15:sp5"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP Applications 15 SP6",
"product": {
"name": "SUSE Linux Enterprise Server for SAP Applications 15 SP6",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP6",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles_sap:15:sp6"
}
}
},
{
"category": "product_name",
"name": "openSUSE Leap 15.6",
"product": {
"name": "openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:leap:15.6"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "python311-PyJWT-2.8.0-150400.8.10.1.noarch as component of SUSE Linux Enterprise Module for Public Cloud 15 SP4",
"product_id": "SUSE Linux Enterprise Module for Public Cloud 15 SP4:python311-PyJWT-2.8.0-150400.8.10.1.noarch"
},
"product_reference": "python311-PyJWT-2.8.0-150400.8.10.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Public Cloud 15 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python311-PyJWT-2.8.0-150400.8.10.1.noarch as component of SUSE Linux Enterprise Module for Python 3 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Python 3 15 SP7:python311-PyJWT-2.8.0-150400.8.10.1.noarch"
},
"product_reference": "python311-PyJWT-2.8.0-150400.8.10.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Python 3 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python311-PyJWT-2.8.0-150400.8.10.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:python311-PyJWT-2.8.0-150400.8.10.1.noarch"
},
"product_reference": "python311-PyJWT-2.8.0-150400.8.10.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python311-PyJWT-2.8.0-150400.8.10.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:python311-PyJWT-2.8.0-150400.8.10.1.noarch"
},
"product_reference": "python311-PyJWT-2.8.0-150400.8.10.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python311-PyJWT-2.8.0-150400.8.10.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:python311-PyJWT-2.8.0-150400.8.10.1.noarch"
},
"product_reference": "python311-PyJWT-2.8.0-150400.8.10.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python311-PyJWT-2.8.0-150400.8.10.1.noarch as component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS",
"product_id": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:python311-PyJWT-2.8.0-150400.8.10.1.noarch"
},
"product_reference": "python311-PyJWT-2.8.0-150400.8.10.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python311-PyJWT-2.8.0-150400.8.10.1.noarch as component of SUSE Linux Enterprise Server 15 SP4-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP4-LTSS:python311-PyJWT-2.8.0-150400.8.10.1.noarch"
},
"product_reference": "python311-PyJWT-2.8.0-150400.8.10.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP4-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python311-PyJWT-2.8.0-150400.8.10.1.noarch as component of SUSE Linux Enterprise Server 15 SP5-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP5-LTSS:python311-PyJWT-2.8.0-150400.8.10.1.noarch"
},
"product_reference": "python311-PyJWT-2.8.0-150400.8.10.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP5-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python311-PyJWT-2.8.0-150400.8.10.1.noarch as component of SUSE Linux Enterprise Server 15 SP6-LTSS",
"product_id": "SUSE Linux Enterprise Server 15 SP6-LTSS:python311-PyJWT-2.8.0-150400.8.10.1.noarch"
},
"product_reference": "python311-PyJWT-2.8.0-150400.8.10.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 15 SP6-LTSS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python311-PyJWT-2.8.0-150400.8.10.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP4",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP4:python311-PyJWT-2.8.0-150400.8.10.1.noarch"
},
"product_reference": "python311-PyJWT-2.8.0-150400.8.10.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python311-PyJWT-2.8.0-150400.8.10.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP5",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP5:python311-PyJWT-2.8.0-150400.8.10.1.noarch"
},
"product_reference": "python311-PyJWT-2.8.0-150400.8.10.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python311-PyJWT-2.8.0-150400.8.10.1.noarch as component of SUSE Linux Enterprise Server for SAP Applications 15 SP6",
"product_id": "SUSE Linux Enterprise Server for SAP Applications 15 SP6:python311-PyJWT-2.8.0-150400.8.10.1.noarch"
},
"product_reference": "python311-PyJWT-2.8.0-150400.8.10.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 15 SP6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python311-PyJWT-2.8.0-150400.8.10.1.noarch as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:python311-PyJWT-2.8.0-150400.8.10.1.noarch"
},
"product_reference": "python311-PyJWT-2.8.0-150400.8.10.1.noarch",
"relates_to_product_reference": "openSUSE Leap 15.6"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-32597",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-32597"
}
],
"notes": [
{
"category": "general",
"text": "PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC. This vulnerability is fixed in 2.12.0.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:python311-PyJWT-2.8.0-150400.8.10.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:python311-PyJWT-2.8.0-150400.8.10.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:python311-PyJWT-2.8.0-150400.8.10.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:python311-PyJWT-2.8.0-150400.8.10.1.noarch",
"SUSE Linux Enterprise Module for Public Cloud 15 SP4:python311-PyJWT-2.8.0-150400.8.10.1.noarch",
"SUSE Linux Enterprise Module for Python 3 15 SP7:python311-PyJWT-2.8.0-150400.8.10.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:python311-PyJWT-2.8.0-150400.8.10.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:python311-PyJWT-2.8.0-150400.8.10.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:python311-PyJWT-2.8.0-150400.8.10.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:python311-PyJWT-2.8.0-150400.8.10.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:python311-PyJWT-2.8.0-150400.8.10.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:python311-PyJWT-2.8.0-150400.8.10.1.noarch",
"openSUSE Leap 15.6:python311-PyJWT-2.8.0-150400.8.10.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-32597",
"url": "https://www.suse.com/security/cve/CVE-2026-32597"
},
{
"category": "external",
"summary": "SUSE Bug 1259616 for CVE-2026-32597",
"url": "https://bugzilla.suse.com/1259616"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:python311-PyJWT-2.8.0-150400.8.10.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:python311-PyJWT-2.8.0-150400.8.10.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:python311-PyJWT-2.8.0-150400.8.10.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:python311-PyJWT-2.8.0-150400.8.10.1.noarch",
"SUSE Linux Enterprise Module for Public Cloud 15 SP4:python311-PyJWT-2.8.0-150400.8.10.1.noarch",
"SUSE Linux Enterprise Module for Python 3 15 SP7:python311-PyJWT-2.8.0-150400.8.10.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:python311-PyJWT-2.8.0-150400.8.10.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:python311-PyJWT-2.8.0-150400.8.10.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:python311-PyJWT-2.8.0-150400.8.10.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:python311-PyJWT-2.8.0-150400.8.10.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:python311-PyJWT-2.8.0-150400.8.10.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:python311-PyJWT-2.8.0-150400.8.10.1.noarch",
"openSUSE Leap 15.6:python311-PyJWT-2.8.0-150400.8.10.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS:python311-PyJWT-2.8.0-150400.8.10.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS:python311-PyJWT-2.8.0-150400.8.10.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS:python311-PyJWT-2.8.0-150400.8.10.1.noarch",
"SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS:python311-PyJWT-2.8.0-150400.8.10.1.noarch",
"SUSE Linux Enterprise Module for Public Cloud 15 SP4:python311-PyJWT-2.8.0-150400.8.10.1.noarch",
"SUSE Linux Enterprise Module for Python 3 15 SP7:python311-PyJWT-2.8.0-150400.8.10.1.noarch",
"SUSE Linux Enterprise Server 15 SP4-LTSS:python311-PyJWT-2.8.0-150400.8.10.1.noarch",
"SUSE Linux Enterprise Server 15 SP5-LTSS:python311-PyJWT-2.8.0-150400.8.10.1.noarch",
"SUSE Linux Enterprise Server 15 SP6-LTSS:python311-PyJWT-2.8.0-150400.8.10.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP4:python311-PyJWT-2.8.0-150400.8.10.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP5:python311-PyJWT-2.8.0-150400.8.10.1.noarch",
"SUSE Linux Enterprise Server for SAP Applications 15 SP6:python311-PyJWT-2.8.0-150400.8.10.1.noarch",
"openSUSE Leap 15.6:python311-PyJWT-2.8.0-150400.8.10.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-04-16T09:19:26Z",
"details": "important"
}
],
"title": "CVE-2026-32597"
}
]
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
Loading…
Loading…