{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Microsoft SQL Server 2017 pour syst\u00e8mes x64 (GDR) versions ant\u00e9rieures \u00e0 14.0.2110.2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Visual Studio 2017 version 15.9 (inclus 15.0 - 15.8) ant\u00e9rieures \u00e0 15.9.80",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft SharePoint Enterprise Server 2016 versions ant\u00e9rieures \u00e0 16.0.5552.1002",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Dynamics 365 Business Central Release Wave 2 2025 versions ant\u00e9rieures \u00e0 27.6",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Dynamics 365 Business Central Release Wave 1 2025 versions ant\u00e9rieures \u00e0 26.12",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft JIRA SAML SSO plugin versions ant\u00e9rieures \u00e0 1.3.3",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Visual Studio 2026 version 18.5 ant\u00e9rieures \u00e0 18.5.3",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft SQL Server 2022 pour syst\u00e8mes x64 (GDR) versions ant\u00e9rieures \u00e0 16.0.1180.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft SharePoint Server 2019 versions ant\u00e9rieures \u00e0 16.0.10417.20128",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "M365 Copilot pour Desktop versions ant\u00e9rieures \u00e0 19.2604.43111.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft SQL Server 2022 pour syst\u00e8mes x64 (CU 24) versions ant\u00e9rieures \u00e0 16.0.4252.3",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft SQL Server 2019 pour syst\u00e8mes x64 (CU 32) versions ant\u00e9rieures \u00e0 15.0.4470.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Data Formulator versions ant\u00e9rieures \u00e0 0.7",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft SQL Server 2016 pour syst\u00e8mes x64 Service Pack 3 (GDR) versions ant\u00e9rieures \u00e0 13.0.6490.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Teams pour Android versions ant\u00e9rieures \u00e0 1.0.0.2026092103",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft SharePoint Server Subscription Edition versions ant\u00e9rieures \u00e0 16.0.19725.20280",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Dynamics 365 (on-premises) version 9.1 ant\u00e9rieures \u00e0 9.1.44.15",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft SQL Server 2025 pour syst\u00e8mes x64 (CU4) versions ant\u00e9rieures \u00e0 17.0.4040.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Visual Studio 2019 version 16.11 (inclus 16.0 - 16.10) ant\u00e9rieures \u00e0 16.11.56",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Visual Studio 2022 version 17.14 ant\u00e9rieures \u00e0 17.14.31",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft SQL Server 2019 pour syst\u00e8mes x64 (GDR) versions ant\u00e9rieures \u00e0 15.0.2170.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft SQL Server 2016 pour syst\u00e8mes x64 Service Pack 3 Azure Connect Feature Pack versions ant\u00e9rieures \u00e0 13.0.7085.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Visual Studio 2022 version 17.12 ant\u00e9rieures \u00e0 17.12.20",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft SQL Server 2017 pour syst\u00e8mes x64 (CU 31) versions ant\u00e9rieures \u00e0 14.0.3530.2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Confluence SAML SSO plugin versions ant\u00e9rieures \u00e0 7.4.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Visual Studio Code - Live Preview extension versions ant\u00e9rieures \u00e0 0.4.19",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft SQL Server 2025 pour syst\u00e8mes x64 (GDR) versions ant\u00e9rieures \u00e0 17.0.1115.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Dynamics 365 Business Central 2026 Release Wave 1 versions ant\u00e9rieures \u00e0 28.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Visual Studio Code versions ant\u00e9rieures \u00e0 1.119.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Dynamics 365 Business Central 2024 Release Wave 2 versions ant\u00e9rieures \u00e0 25.18",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Power Automate pour Desktop versions ant\u00e9rieures \u00e0 2.67",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-40417",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-40417"
    },
    {
      "name": "CVE-2026-42898",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42898"
    },
    {
      "name": "CVE-2026-41612",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41612"
    },
    {
      "name": "CVE-2026-40365",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-40365"
    },
    {
      "name": "CVE-2026-41614",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41614"
    },
    {
      "name": "CVE-2026-41602",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41602"
    },
    {
      "name": "CVE-2026-42833",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42833"
    },
    {
      "name": "CVE-2026-40368",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-40368"
    },
    {
      "name": "CVE-2026-32175",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-32175"
    },
    {
      "name": "CVE-2026-33110",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-33110"
    },
    {
      "name": "CVE-2026-41613",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41613"
    },
    {
      "name": "CVE-2026-41094",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41094"
    },
    {
      "name": "CVE-2026-6665",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-6665"
    },
    {
      "name": "CVE-2026-40357",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-40357"
    },
    {
      "name": "CVE-2026-41603",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41603"
    },
    {
      "name": "CVE-2026-35439",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-35439"
    },
    {
      "name": "CVE-2026-40367",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-40367"
    },
    {
      "name": "CVE-2026-6667",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-6667"
    },
    {
      "name": "CVE-2026-6664",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-6664"
    },
    {
      "name": "CVE-2026-32177",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-32177"
    },
    {
      "name": "CVE-2026-40370",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-40370"
    },
    {
      "name": "CVE-2026-41636",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41636"
    },
    {
      "name": "CVE-2026-41109",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41109"
    },
    {
      "name": "CVE-2026-44656",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-44656"
    },
    {
      "name": "CVE-2026-6666",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-6666"
    },
    {
      "name": "CVE-2026-41611",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41611"
    },
    {
      "name": "CVE-2026-40374",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-40374"
    },
    {
      "name": "CVE-2026-41605",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41605"
    },
    {
      "name": "CVE-2026-41103",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41103"
    },
    {
      "name": "CVE-2026-33112",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-33112"
    },
    {
      "name": "CVE-2026-32185",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-32185"
    },
    {
      "name": "CVE-2026-45130",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-45130"
    },
    {
      "name": "CVE-2025-48431",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-48431"
    },
    {
      "name": "CVE-2026-41610",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41610"
    }
  ],
  "initial_release_date": "2026-05-13T00:00:00",
  "last_revision_date": "2026-05-13T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-0588",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-05-13T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Microsoft. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Microsoft",
  "vendor_advisories": [
    {
      "published_at": "2026-05-12",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-33110",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33110"
    },
    {
      "published_at": "2026-05-10",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-6664",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-6664"
    },
    {
      "published_at": "2026-05-12",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-32185",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32185"
    },
    {
      "published_at": "2026-04-30",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-41602",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41602"
    },
    {
      "published_at": "2026-05-10",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-45130",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45130"
    },
    {
      "published_at": "2026-04-30",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-48431",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-48431"
    },
    {
      "published_at": "2026-05-10",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-6665",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-6665"
    },
    {
      "published_at": "2026-05-12",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-41103",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41103"
    },
    {
      "published_at": "2026-05-12",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-35439",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35439"
    },
    {
      "published_at": "2026-05-12",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-32177",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32177"
    },
    {
      "published_at": "2026-05-12",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-41610",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41610"
    },
    {
      "published_at": "2026-05-12",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-40417",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40417"
    },
    {
      "published_at": "2026-05-12",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-42898",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42898"
    },
    {
      "published_at": "2026-05-12",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-41614",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41614"
    },
    {
      "published_at": "2026-05-12",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-41612",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41612"
    },
    {
      "published_at": "2026-05-12",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-40374",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40374"
    },
    {
      "published_at": "2026-04-30",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-41636",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41636"
    },
    {
      "published_at": "2026-05-10",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-44656",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44656"
    },
    {
      "published_at": "2026-05-12",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-32175",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32175"
    },
    {
      "published_at": "2026-05-12",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-40370",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40370"
    },
    {
      "published_at": "2026-05-12",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-40368",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40368"
    },
    {
      "published_at": "2026-04-30",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-41605",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41605"
    },
    {
      "published_at": "2026-05-12",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-41611",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41611"
    },
    {
      "published_at": "2026-05-12",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-41109",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41109"
    },
    {
      "published_at": "2026-05-10",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-6667",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-6667"
    },
    {
      "published_at": "2026-05-10",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-6666",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-6666"
    },
    {
      "published_at": "2026-05-12",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-40365",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40365"
    },
    {
      "published_at": "2026-05-12",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-33112",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33112"
    },
    {
      "published_at": "2026-05-12",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-40357",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40357"
    },
    {
      "published_at": "2026-05-12",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-41094",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41094"
    },
    {
      "published_at": "2026-04-30",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-41603",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41603"
    },
    {
      "published_at": "2026-05-12",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-42833",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42833"
    },
    {
      "published_at": "2026-05-12",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-41613",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41613"
    },
    {
      "published_at": "2026-05-12",
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-40367",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40367"
    }
  ]
}

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Thrift",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "0.23.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "security@apache.org"
    },
    {
      "affectedData": [
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:multicluster_globalhub:1.3::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "multicluster-globalhub/multicluster-globalhub-grafana-rhel9",
          "product": "Multicluster Global Hub 1.3.4",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1779212259",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:multicluster_globalhub:1.4::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "multicluster-globalhub/multicluster-globalhub-grafana-rhel9",
          "product": "Multicluster Global Hub 1.4.5",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1779579439",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:multicluster_globalhub:1.6::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "multicluster-globalhub/multicluster-globalhub-grafana-rhel9",
          "product": "Multicluster Global Hub 1.6.2",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1780167118",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:acm:2.14::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhacm2/acm-grafana-rhel9",
          "product": "Red Hat Advanced Cluster Management for Kubernetes 2.14",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1782693386",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:acm:2.15::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhacm2/acm-grafana-rhel9",
          "product": "Red Hat Advanced Cluster Management for Kubernetes 2.15",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1780677003",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:multicluster_globalhub:1.5::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "multicluster-globalhub/multicluster-globalhub-grafana-rhel9",
          "product": "Red Hat multicluster global hub 1.5.2",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1778867753",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift_distributed_tracing:3.9::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhosdt/tempo-jaeger-query-rhel9",
          "product": "Red Hat OpenShift distributed tracing 3.9.1",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1778158391",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift_distributed_tracing:3.9::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhosdt/tempo-query-rhel9",
          "product": "Red Hat OpenShift distributed tracing 3.9.1",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1778158343",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:openshift_distributed_tracing:3.9::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "rhosdt/tempo-rhel9",
          "product": "Red Hat OpenShift distributed tracing 3.9.1",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1778158374",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:service_mesh:2"
          ],
          "defaultStatus": "unaffected",
          "packageName": "openshift-service-mesh/istio-rhel8-operator",
          "product": "OpenShift Service Mesh 2",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:ai_inference_server:3"
          ],
          "defaultStatus": "affected",
          "packageName": "rhaiis/vllm-cpu-rhel9",
          "product": "Red Hat AI Inference Server",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:ai_inference_server:3"
          ],
          "defaultStatus": "affected",
          "packageName": "rhaiis/vllm-cuda-rhel9",
          "product": "Red Hat AI Inference Server",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:ai_inference_server:3"
          ],
          "defaultStatus": "affected",
          "packageName": "rhaiis/vllm-rocm-rhel9",
          "product": "Red Hat AI Inference Server",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:ai_inference_server:3"
          ],
          "defaultStatus": "affected",
          "packageName": "rhaiis/vllm-tpu-rhel9",
          "product": "Red Hat AI Inference Server",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux_ai:3"
          ],
          "defaultStatus": "affected",
          "packageName": "rhelai3/bootc-aws-cuda-rhel9",
          "product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux_ai:3"
          ],
          "defaultStatus": "affected",
          "packageName": "rhelai3/bootc-azure-cuda-rhel9",
          "product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux_ai:3"
          ],
          "defaultStatus": "affected",
          "packageName": "rhelai3/bootc-azure-rocm-rhel9",
          "product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux_ai:3"
          ],
          "defaultStatus": "affected",
          "packageName": "rhelai3/bootc-cuda-rhel9",
          "product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux_ai:3"
          ],
          "defaultStatus": "affected",
          "packageName": "rhelai3/bootc-gcp-cuda-rhel9",
          "product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux_ai:3"
          ],
          "defaultStatus": "affected",
          "packageName": "rhelai3/bootc-rocm-rhel9",
          "product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift_ai"
          ],
          "defaultStatus": "unaffected",
          "packageName": "rhoai/odh-kf-notebook-controller-rhel8",
          "product": "Red Hat OpenShift AI (RHOAI)",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift_ai"
          ],
          "defaultStatus": "unaffected",
          "packageName": "rhoai/odh-model-registry-rhel9",
          "product": "Red Hat OpenShift AI (RHOAI)",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift_ai"
          ],
          "defaultStatus": "unaffected",
          "packageName": "rhoai/odh-notebook-controller-rhel8",
          "product": "Red Hat OpenShift AI (RHOAI)",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift4/oc-mirror-plugin-rhel9",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift4/ztp-site-generate-rhel8",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift_distributed_tracing:3"
          ],
          "defaultStatus": "unaffected",
          "packageName": "rhosdt/opentelemetry-collector-rhel9",
          "product": "Red Hat OpenShift distributed tracing 3",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift_gitops:1"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift-gitops-1/argocd-rhel8",
          "product": "Red Hat OpenShift GitOps",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift_gitops:1"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift-gitops-1/argocd-rhel9",
          "product": "Red Hat OpenShift GitOps",
          "vendor": "Red Hat"
        }
      ],
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:thrift:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "0CE7604A-DA43-44E3-9840-9E3696223DD5",
              "versionEndExcluding": "0.23.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift.\n\nThis issue affects Apache Thrift: before 0.23.0.\n\nUsers are recommended to upgrade to version 0.23.0, which fixes the issue."
    }
  ],
  "id": "CVE-2026-41603",
  "lastModified": "2026-07-22T12:17:50.600",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.4,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 5.2,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 8.2,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 4.2,
        "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-41603",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-04-28T14:13:58.705528Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-04-28T10:16:03.113",
  "references": [
    {
      "source": "security@apache.org",
      "tags": [
        "Mailing List",
        "Patch",
        "Release Notes"
      ],
      "url": "https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2026/04/28/7"
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "url": "https://access.redhat.com/errata/RHSA-2026:14885"
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "url": "https://access.redhat.com/errata/RHSA-2026:21769"
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "url": "https://access.redhat.com/errata/RHSA-2026:22347"
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "url": "https://access.redhat.com/errata/RHSA-2026:22423"
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "url": "https://access.redhat.com/errata/RHSA-2026:23345"
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "url": "https://access.redhat.com/errata/RHSA-2026:24539"
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "url": "https://access.redhat.com/errata/RHSA-2026:36882"
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "url": "https://access.redhat.com/security/cve/CVE-2026-41603"
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463411"
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41603.json"
    }
  ],
  "sourceIdentifier": "security@apache.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-297"
        },
        {
          "lang": "en",
          "value": "CWE-306"
        }
      ],
      "source": "security@apache.org",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-295"
        }
      ],
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "type": "Secondary"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-41603"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-295",
      "CWE-297"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-04-28T10:16:03Z",
    "severity": "HIGH"
  },
  "details": "Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift.\n\nThis issue affects Apache Thrift: before 0.23.0.\n\nUsers are recommended to upgrade to version 0.23.0, which fixes the issue.",
  "id": "GHSA-gf47-qgg5-9g9q",
  "modified": "2026-07-09T15:32:00Z",
  "published": "2026-04-28T12:31:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41603"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:14885"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:21769"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:22347"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:22423"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:23345"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:24539"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:36882"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2026-41603"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463411"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql"
    },
    {
      "type": "WEB",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41603.json"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2026/04/28/7"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Public",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
        "title": "Disclaimer"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "secure@microsoft.com",
      "name": "Microsoft Security Response Center",
      "namespace": "https://msrc.microsoft.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "CVE-2026-41603 Apache Thrift: Java TSSLTransportFactory hostname verification - VEX",
        "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-41603.json"
      },
      {
        "category": "external",
        "summary": "Microsoft Support Lifecycle",
        "url": "https://support.microsoft.com/lifecycle"
      },
      {
        "category": "external",
        "summary": "Common Vulnerability Scoring System",
        "url": "https://www.first.org/cvss"
      }
    ],
    "title": "Apache Thrift: Java TSSLTransportFactory hostname verification",
    "tracking": {
      "current_release_date": "2026-05-13T01:40:12.000Z",
      "generator": {
        "date": "2026-05-13T07:22:36.591Z",
        "engine": {
          "name": "MSRC Generator",
          "version": "1.0"
        }
      },
      "id": "msrc_CVE-2026-41603",
      "initial_release_date": "2026-04-02T00:00:00.000Z",
      "revision_history": [
        {
          "date": "2026-04-30T01:11:14.000Z",
          "legacy_version": "1",
          "number": "1",
          "summary": "Information published."
        },
        {
          "date": "2026-05-13T01:40:12.000Z",
          "legacy_version": "2",
          "number": "2",
          "summary": "Information published."
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "3.0",
                "product": {
                  "name": "Azure Linux 3.0",
                  "product_id": "17084"
                }
              }
            ],
            "category": "product_name",
            "name": "Azure Linux"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cazl3 thrift 0:0.15.0-5.azl3",
                "product": {
                  "name": "\u003cazl3 thrift 0:0.15.0-5.azl3",
                  "product_id": "1"
                }
              },
              {
                "category": "product_version",
                "name": "azl3 thrift 0:0.15.0-5.azl3",
                "product": {
                  "name": "azl3 thrift 0:0.15.0-5.azl3",
                  "product_id": "17626"
                }
              }
            ],
            "category": "product_name",
            "name": "thrift"
          }
        ],
        "category": "vendor",
        "name": "Microsoft"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003cazl3 thrift 0:0.15.0-5.azl3 as a component of Azure Linux 3.0",
          "product_id": "17084-1"
        },
        "product_reference": "1",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 thrift 0:0.15.0-5.azl3 as a component of Azure Linux 3.0",
          "product_id": "17626-17084"
        },
        "product_reference": "17626",
        "relates_to_product_reference": "17084"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-41603",
      "cwe": {
        "id": "CWE-297",
        "name": "Improper Validation of Certificate with Host Mismatch"
      },
      "notes": [
        {
          "category": "general",
          "text": "apache",
          "title": "Assigning CNA"
        }
      ],
      "product_status": {
        "fixed": [
          "17626-17084"
        ],
        "known_affected": [
          "17084-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-41603 Apache Thrift: Java TSSLTransportFactory hostname verification - VEX",
          "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-41603.json"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-30T01:11:14.000Z",
          "details": "0:0.15.0-6.azl3:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade",
          "product_ids": [
            "17084-1"
          ],
          "url": "https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"
        }
      ],
      "title": "Apache Thrift: Java TSSLTransportFactory hostname verification"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat OpenShift distributed tracing platform (Tempo) 3.9.3 has been released",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This release of the Red Hat OpenShift distributed tracing platform (Tempo) provides security improvements and bug fixes.\n\n\nBreaking changes:\n\n* None.\n\n\nDeprecations:\n\n* None.\n\n\nTechnology Preview features:\n\n* None.\n\n\nEnhancements:\n\n* None.\n\n\nBug fixes:\n\n* Apache Thrift TFramedTransport integer overflow vulnerability is fixed: Previously, the Apache Thrift TFramedTransport Go language implementation contained an integer overflow vulnerability. An attacker could exploit this wraparound flaw to cause unexpected behavior or resource exhaustion, leading to a denial of service. With this update, the integer overflow vulnerability is fixed. For more information, see https://access.redhat.com/security/cve/cve-2026-41602.\n\n* Apache Thrift server certificate validation vulnerability is fixed: Previously, Apache Thrift did not properly validate server certificates. Apache Thrift accepted certificates even when the hostname did not match the expected hostname. A remote attacker could exploit this flaw to impersonate a legitimate server, intercept or alter sensitive communications, and gain unauthorized access or disclose information. With this update, Apache Thrift properly validates server certificate hostnames. For more information, see https://access.redhat.com/security/cve/cve-2026-41603.\n\n* Apache Thrift out-of-bounds read vulnerability is fixed: Previously, Apache Thrift contained an out-of-bounds read vulnerability. An attacker could exploit this flaw to access memory outside of allocated bounds, resulting in information disclosure or a denial-of-service (DoS) condition. With this update, Apache Thrift correctly validates memory access boundaries. For more information, see https://access.redhat.com/security/cve/cve-2026-41604 and https://access.redhat.com/security/cve/cve-2026-41607.\n\n* Apache Thrift integer overflow vulnerability is fixed: Previously, Apache Thrift contained an integer overflow vulnerability. An attacker could exploit this wraparound flaw to cause unexpected behavior or resource exhaustion, impacting system availability or integrity. With this update, Apache Thrift correctly handles integer operations to prevent overflow conditions. For more information, see https://access.redhat.com/security/cve/cve-2026-41605.\n\n* Apache Thrift uncontrolled recursion vulnerability is fixed: Previously, Apache Thrift contained an uncontrolled recursion vulnerability. When Apache Thrift processed specially crafted input, a remote attacker could trigger a denial-of-service (DoS) condition, causing excessive resource consumption and system unavailability. With this update, the recursion vulnerability is fixed, and remote attackers can no longer exploit this flaw. For more information, see https://access.redhat.com/security/cve/cve-2026-41606.\n\n\nKnown issues:\n\n* None.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:14885",
        "url": "https://access.redhat.com/errata/RHSA-2026:14885"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-41602",
        "url": "https://access.redhat.com/security/cve/CVE-2026-41602"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-41603",
        "url": "https://access.redhat.com/security/cve/CVE-2026-41603"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-41604",
        "url": "https://access.redhat.com/security/cve/CVE-2026-41604"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-41605",
        "url": "https://access.redhat.com/security/cve/CVE-2026-41605"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-41606",
        "url": "https://access.redhat.com/security/cve/CVE-2026-41606"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-41607",
        "url": "https://access.redhat.com/security/cve/CVE-2026-41607"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/distributed_tracing/distributed-tracing-platform-tempo",
        "url": "https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/distributed_tracing/distributed-tracing-platform-tempo"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_14885.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat OpenShift distributed tracing platform (Tempo) 3.9.3 release",
    "tracking": {
      "current_release_date": "2026-07-28T13:11:37+00:00",
      "generator": {
        "date": "2026-07-28T13:11:37+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.7"
        }
      },
      "id": "RHSA-2026:14885",
      "initial_release_date": "2026-05-07T16:23:20+00:00",
      "revision_history": [
        {
          "date": "2026-05-07T16:23:20+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-07-25T05:39:32+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-07-28T13:11:37+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat OpenShift distributed tracing 3.9.1",
                "product": {
                  "name": "Red Hat OpenShift distributed tracing 3.9.1",
                  "product_id": "Red Hat OpenShift distributed tracing 3.9.1",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openshift_distributed_tracing:3.9::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenShift distributed tracing"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:9aca25cbc3ab1ba653d3b427df28f2b5ec1c4c041892e5e7ebd817be0ac56017_amd64",
                "product": {
                  "name": "registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:9aca25cbc3ab1ba653d3b427df28f2b5ec1c4c041892e5e7ebd817be0ac56017_amd64",
                  "product_id": "registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:9aca25cbc3ab1ba653d3b427df28f2b5ec1c4c041892e5e7ebd817be0ac56017_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/tempo-operator-bundle@sha256%3A9aca25cbc3ab1ba653d3b427df28f2b5ec1c4c041892e5e7ebd817be0ac56017?arch=amd64\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1778160493"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:841e1897e543548f5494c9495463514d4286697a760326b67c11958933a7ac70_amd64",
                "product": {
                  "name": "registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:841e1897e543548f5494c9495463514d4286697a760326b67c11958933a7ac70_amd64",
                  "product_id": "registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:841e1897e543548f5494c9495463514d4286697a760326b67c11958933a7ac70_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/tempo-gateway-rhel9@sha256%3A841e1897e543548f5494c9495463514d4286697a760326b67c11958933a7ac70?arch=amd64\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1778156610"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:f6e5c856ec74d0a7e858448960c4d09d2a24ac7bdce7ff18d1981bd23a45d6cb_amd64",
                "product": {
                  "name": "registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:f6e5c856ec74d0a7e858448960c4d09d2a24ac7bdce7ff18d1981bd23a45d6cb_amd64",
                  "product_id": "registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:f6e5c856ec74d0a7e858448960c4d09d2a24ac7bdce7ff18d1981bd23a45d6cb_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/tempo-jaeger-query-rhel9@sha256%3Af6e5c856ec74d0a7e858448960c4d09d2a24ac7bdce7ff18d1981bd23a45d6cb?arch=amd64\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1778158391"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:37069c4ac61fc810096df8c25b1d12f95b04da5f11892fb4c6bcd3a3479d3777_amd64",
                "product": {
                  "name": "registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:37069c4ac61fc810096df8c25b1d12f95b04da5f11892fb4c6bcd3a3479d3777_amd64",
                  "product_id": "registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:37069c4ac61fc810096df8c25b1d12f95b04da5f11892fb4c6bcd3a3479d3777_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/tempo-gateway-opa-rhel9@sha256%3A37069c4ac61fc810096df8c25b1d12f95b04da5f11892fb4c6bcd3a3479d3777?arch=amd64\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1778158323"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:e2c38ca7fa1257940589d6eace9ad5d95c6dbaccf36ae04ce296d0350258e0a0_amd64",
                "product": {
                  "name": "registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:e2c38ca7fa1257940589d6eace9ad5d95c6dbaccf36ae04ce296d0350258e0a0_amd64",
                  "product_id": "registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:e2c38ca7fa1257940589d6eace9ad5d95c6dbaccf36ae04ce296d0350258e0a0_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/tempo-rhel9-operator@sha256%3Ae2c38ca7fa1257940589d6eace9ad5d95c6dbaccf36ae04ce296d0350258e0a0?arch=amd64\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1778158321"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:745c62848b8ab43bbcddf75a79b53662e0ac0aff050281c879e01c4c213accc3_amd64",
                "product": {
                  "name": "registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:745c62848b8ab43bbcddf75a79b53662e0ac0aff050281c879e01c4c213accc3_amd64",
                  "product_id": "registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:745c62848b8ab43bbcddf75a79b53662e0ac0aff050281c879e01c4c213accc3_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/tempo-query-rhel9@sha256%3A745c62848b8ab43bbcddf75a79b53662e0ac0aff050281c879e01c4c213accc3?arch=amd64\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1778158343"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhosdt/tempo-rhel9@sha256:5f227627f918d7a8b6328843da37547b54271ea93045b9a5d9ede82348b62d01_amd64",
                "product": {
                  "name": "registry.redhat.io/rhosdt/tempo-rhel9@sha256:5f227627f918d7a8b6328843da37547b54271ea93045b9a5d9ede82348b62d01_amd64",
                  "product_id": "registry.redhat.io/rhosdt/tempo-rhel9@sha256:5f227627f918d7a8b6328843da37547b54271ea93045b9a5d9ede82348b62d01_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/tempo-rhel9@sha256%3A5f227627f918d7a8b6328843da37547b54271ea93045b9a5d9ede82348b62d01?arch=amd64\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1778158374"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:d1a3996d3879700be89bad37bb688f5016078a11dbdda894932115da370508ee_arm64",
                "product": {
                  "name": "registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:d1a3996d3879700be89bad37bb688f5016078a11dbdda894932115da370508ee_arm64",
                  "product_id": "registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:d1a3996d3879700be89bad37bb688f5016078a11dbdda894932115da370508ee_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/tempo-gateway-rhel9@sha256%3Ad1a3996d3879700be89bad37bb688f5016078a11dbdda894932115da370508ee?arch=arm64\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1778156610"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:bea6c0fb2bead67356a76060901018b90c2cda12e5ef0ffca8993e16b761ab41_arm64",
                "product": {
                  "name": "registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:bea6c0fb2bead67356a76060901018b90c2cda12e5ef0ffca8993e16b761ab41_arm64",
                  "product_id": "registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:bea6c0fb2bead67356a76060901018b90c2cda12e5ef0ffca8993e16b761ab41_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/tempo-jaeger-query-rhel9@sha256%3Abea6c0fb2bead67356a76060901018b90c2cda12e5ef0ffca8993e16b761ab41?arch=arm64\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1778158391"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:20951bbce71da848cf595ae1480a0c46b131b59190fd657774a8932889a8e5da_arm64",
                "product": {
                  "name": "registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:20951bbce71da848cf595ae1480a0c46b131b59190fd657774a8932889a8e5da_arm64",
                  "product_id": "registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:20951bbce71da848cf595ae1480a0c46b131b59190fd657774a8932889a8e5da_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/tempo-gateway-opa-rhel9@sha256%3A20951bbce71da848cf595ae1480a0c46b131b59190fd657774a8932889a8e5da?arch=arm64\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1778158323"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a12c6e4a54dfe009700be799c8036a09a8845bc84dea533c024ffac0a65dc491_arm64",
                "product": {
                  "name": "registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a12c6e4a54dfe009700be799c8036a09a8845bc84dea533c024ffac0a65dc491_arm64",
                  "product_id": "registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a12c6e4a54dfe009700be799c8036a09a8845bc84dea533c024ffac0a65dc491_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/tempo-rhel9-operator@sha256%3Aa12c6e4a54dfe009700be799c8036a09a8845bc84dea533c024ffac0a65dc491?arch=arm64\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1778158321"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:d7c013a4088c668aacbc00047f00cb1cc0041676f9f8d5a9971ab53fd15d5a69_arm64",
                "product": {
                  "name": "registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:d7c013a4088c668aacbc00047f00cb1cc0041676f9f8d5a9971ab53fd15d5a69_arm64",
                  "product_id": "registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:d7c013a4088c668aacbc00047f00cb1cc0041676f9f8d5a9971ab53fd15d5a69_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/tempo-query-rhel9@sha256%3Ad7c013a4088c668aacbc00047f00cb1cc0041676f9f8d5a9971ab53fd15d5a69?arch=arm64\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1778158343"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhosdt/tempo-rhel9@sha256:3345dc986a756c37e0636877a17dfa8483d12338e67d522419e85667f65cfa3e_arm64",
                "product": {
                  "name": "registry.redhat.io/rhosdt/tempo-rhel9@sha256:3345dc986a756c37e0636877a17dfa8483d12338e67d522419e85667f65cfa3e_arm64",
                  "product_id": "registry.redhat.io/rhosdt/tempo-rhel9@sha256:3345dc986a756c37e0636877a17dfa8483d12338e67d522419e85667f65cfa3e_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/tempo-rhel9@sha256%3A3345dc986a756c37e0636877a17dfa8483d12338e67d522419e85667f65cfa3e?arch=arm64\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1778158374"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "arm64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:e78a27a6a17ad3f2bd5771ada6ac2357156cd351dc3e976d0495fcdc38a4d891_ppc64le",
                "product": {
                  "name": "registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:e78a27a6a17ad3f2bd5771ada6ac2357156cd351dc3e976d0495fcdc38a4d891_ppc64le",
                  "product_id": "registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:e78a27a6a17ad3f2bd5771ada6ac2357156cd351dc3e976d0495fcdc38a4d891_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/tempo-gateway-rhel9@sha256%3Ae78a27a6a17ad3f2bd5771ada6ac2357156cd351dc3e976d0495fcdc38a4d891?arch=ppc64le\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1778156610"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:d21b8336c12507aabdb03ecee43d5e93633b202ea880ae6aced0426b40d972f6_ppc64le",
                "product": {
                  "name": "registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:d21b8336c12507aabdb03ecee43d5e93633b202ea880ae6aced0426b40d972f6_ppc64le",
                  "product_id": "registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:d21b8336c12507aabdb03ecee43d5e93633b202ea880ae6aced0426b40d972f6_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/tempo-jaeger-query-rhel9@sha256%3Ad21b8336c12507aabdb03ecee43d5e93633b202ea880ae6aced0426b40d972f6?arch=ppc64le\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1778158391"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:94fa2f56d060b2ac8a384db29bf073683bef50cd60724e893ee1dcb945424517_ppc64le",
                "product": {
                  "name": "registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:94fa2f56d060b2ac8a384db29bf073683bef50cd60724e893ee1dcb945424517_ppc64le",
                  "product_id": "registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:94fa2f56d060b2ac8a384db29bf073683bef50cd60724e893ee1dcb945424517_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/tempo-gateway-opa-rhel9@sha256%3A94fa2f56d060b2ac8a384db29bf073683bef50cd60724e893ee1dcb945424517?arch=ppc64le\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1778158323"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:815f222ec62bad59caede1682990af6367fcc4354013b5da96a7b67dd311a4b9_ppc64le",
                "product": {
                  "name": "registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:815f222ec62bad59caede1682990af6367fcc4354013b5da96a7b67dd311a4b9_ppc64le",
                  "product_id": "registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:815f222ec62bad59caede1682990af6367fcc4354013b5da96a7b67dd311a4b9_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/tempo-rhel9-operator@sha256%3A815f222ec62bad59caede1682990af6367fcc4354013b5da96a7b67dd311a4b9?arch=ppc64le\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1778158321"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:50bd4b1c745b916a8127a071e9d79dbde85268ab19c49ffb431863f9222152f6_ppc64le",
                "product": {
                  "name": "registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:50bd4b1c745b916a8127a071e9d79dbde85268ab19c49ffb431863f9222152f6_ppc64le",
                  "product_id": "registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:50bd4b1c745b916a8127a071e9d79dbde85268ab19c49ffb431863f9222152f6_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/tempo-query-rhel9@sha256%3A50bd4b1c745b916a8127a071e9d79dbde85268ab19c49ffb431863f9222152f6?arch=ppc64le\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1778158343"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhosdt/tempo-rhel9@sha256:cb81f87ad3ed182494ec8f8f4d2a0229a28b716ae27f946d221077961534d9cc_ppc64le",
                "product": {
                  "name": "registry.redhat.io/rhosdt/tempo-rhel9@sha256:cb81f87ad3ed182494ec8f8f4d2a0229a28b716ae27f946d221077961534d9cc_ppc64le",
                  "product_id": "registry.redhat.io/rhosdt/tempo-rhel9@sha256:cb81f87ad3ed182494ec8f8f4d2a0229a28b716ae27f946d221077961534d9cc_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/tempo-rhel9@sha256%3Acb81f87ad3ed182494ec8f8f4d2a0229a28b716ae27f946d221077961534d9cc?arch=ppc64le\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1778158374"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:58739fdf7b671103fddd089db340747090d46018435d2f6519fb00436f08684f_s390x",
                "product": {
                  "name": "registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:58739fdf7b671103fddd089db340747090d46018435d2f6519fb00436f08684f_s390x",
                  "product_id": "registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:58739fdf7b671103fddd089db340747090d46018435d2f6519fb00436f08684f_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/tempo-gateway-rhel9@sha256%3A58739fdf7b671103fddd089db340747090d46018435d2f6519fb00436f08684f?arch=s390x\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1778156610"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:cf73a80390a85a34b6b95a097a3e00c0ac5ed1e6e0bd396c1f55233b59de70ef_s390x",
                "product": {
                  "name": "registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:cf73a80390a85a34b6b95a097a3e00c0ac5ed1e6e0bd396c1f55233b59de70ef_s390x",
                  "product_id": "registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:cf73a80390a85a34b6b95a097a3e00c0ac5ed1e6e0bd396c1f55233b59de70ef_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/tempo-jaeger-query-rhel9@sha256%3Acf73a80390a85a34b6b95a097a3e00c0ac5ed1e6e0bd396c1f55233b59de70ef?arch=s390x\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1778158391"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:3bdaf268da97b95f85a09a18e42e2cfe61ee56b0131b6f86ac4a41fac4854650_s390x",
                "product": {
                  "name": "registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:3bdaf268da97b95f85a09a18e42e2cfe61ee56b0131b6f86ac4a41fac4854650_s390x",
                  "product_id": "registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:3bdaf268da97b95f85a09a18e42e2cfe61ee56b0131b6f86ac4a41fac4854650_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/tempo-gateway-opa-rhel9@sha256%3A3bdaf268da97b95f85a09a18e42e2cfe61ee56b0131b6f86ac4a41fac4854650?arch=s390x\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1778158323"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0fd2089ab716a8733ccdaa909eb7d8663c69de0c87cfc6551ca5a7b93c295a7b_s390x",
                "product": {
                  "name": "registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0fd2089ab716a8733ccdaa909eb7d8663c69de0c87cfc6551ca5a7b93c295a7b_s390x",
                  "product_id": "registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0fd2089ab716a8733ccdaa909eb7d8663c69de0c87cfc6551ca5a7b93c295a7b_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/tempo-rhel9-operator@sha256%3A0fd2089ab716a8733ccdaa909eb7d8663c69de0c87cfc6551ca5a7b93c295a7b?arch=s390x\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1778158321"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:5e922a6dc5973688e531cb1bcbb7a9a414f260d64be9c0a66701b7c050f8ed65_s390x",
                "product": {
                  "name": "registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:5e922a6dc5973688e531cb1bcbb7a9a414f260d64be9c0a66701b7c050f8ed65_s390x",
                  "product_id": "registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:5e922a6dc5973688e531cb1bcbb7a9a414f260d64be9c0a66701b7c050f8ed65_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/tempo-query-rhel9@sha256%3A5e922a6dc5973688e531cb1bcbb7a9a414f260d64be9c0a66701b7c050f8ed65?arch=s390x\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1778158343"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhosdt/tempo-rhel9@sha256:f9a90f6a24678435a08a9783ac7612629b0702633b9405540b02eb5a6da4c6c9_s390x",
                "product": {
                  "name": "registry.redhat.io/rhosdt/tempo-rhel9@sha256:f9a90f6a24678435a08a9783ac7612629b0702633b9405540b02eb5a6da4c6c9_s390x",
                  "product_id": "registry.redhat.io/rhosdt/tempo-rhel9@sha256:f9a90f6a24678435a08a9783ac7612629b0702633b9405540b02eb5a6da4c6c9_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/tempo-rhel9@sha256%3Af9a90f6a24678435a08a9783ac7612629b0702633b9405540b02eb5a6da4c6c9?arch=s390x\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1778158374"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:20951bbce71da848cf595ae1480a0c46b131b59190fd657774a8932889a8e5da_arm64 as a component of Red Hat OpenShift distributed tracing 3.9.1",
          "product_id": "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:20951bbce71da848cf595ae1480a0c46b131b59190fd657774a8932889a8e5da_arm64"
        },
        "product_reference": "registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:20951bbce71da848cf595ae1480a0c46b131b59190fd657774a8932889a8e5da_arm64",
        "relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:37069c4ac61fc810096df8c25b1d12f95b04da5f11892fb4c6bcd3a3479d3777_amd64 as a component of Red Hat OpenShift distributed tracing 3.9.1",
          "product_id": "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:37069c4ac61fc810096df8c25b1d12f95b04da5f11892fb4c6bcd3a3479d3777_amd64"
        },
        "product_reference": "registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:37069c4ac61fc810096df8c25b1d12f95b04da5f11892fb4c6bcd3a3479d3777_amd64",
        "relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:3bdaf268da97b95f85a09a18e42e2cfe61ee56b0131b6f86ac4a41fac4854650_s390x as a component of Red Hat OpenShift distributed tracing 3.9.1",
          "product_id": "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:3bdaf268da97b95f85a09a18e42e2cfe61ee56b0131b6f86ac4a41fac4854650_s390x"
        },
        "product_reference": "registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:3bdaf268da97b95f85a09a18e42e2cfe61ee56b0131b6f86ac4a41fac4854650_s390x",
        "relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:94fa2f56d060b2ac8a384db29bf073683bef50cd60724e893ee1dcb945424517_ppc64le as a component of Red Hat OpenShift distributed tracing 3.9.1",
          "product_id": "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:94fa2f56d060b2ac8a384db29bf073683bef50cd60724e893ee1dcb945424517_ppc64le"
        },
        "product_reference": "registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:94fa2f56d060b2ac8a384db29bf073683bef50cd60724e893ee1dcb945424517_ppc64le",
        "relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:58739fdf7b671103fddd089db340747090d46018435d2f6519fb00436f08684f_s390x as a component of Red Hat OpenShift distributed tracing 3.9.1",
          "product_id": "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:58739fdf7b671103fddd089db340747090d46018435d2f6519fb00436f08684f_s390x"
        },
        "product_reference": "registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:58739fdf7b671103fddd089db340747090d46018435d2f6519fb00436f08684f_s390x",
        "relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:841e1897e543548f5494c9495463514d4286697a760326b67c11958933a7ac70_amd64 as a component of Red Hat OpenShift distributed tracing 3.9.1",
          "product_id": "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:841e1897e543548f5494c9495463514d4286697a760326b67c11958933a7ac70_amd64"
        },
        "product_reference": "registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:841e1897e543548f5494c9495463514d4286697a760326b67c11958933a7ac70_amd64",
        "relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:d1a3996d3879700be89bad37bb688f5016078a11dbdda894932115da370508ee_arm64 as a component of Red Hat OpenShift distributed tracing 3.9.1",
          "product_id": "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:d1a3996d3879700be89bad37bb688f5016078a11dbdda894932115da370508ee_arm64"
        },
        "product_reference": "registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:d1a3996d3879700be89bad37bb688f5016078a11dbdda894932115da370508ee_arm64",
        "relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:e78a27a6a17ad3f2bd5771ada6ac2357156cd351dc3e976d0495fcdc38a4d891_ppc64le as a component of Red Hat OpenShift distributed tracing 3.9.1",
          "product_id": "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:e78a27a6a17ad3f2bd5771ada6ac2357156cd351dc3e976d0495fcdc38a4d891_ppc64le"
        },
        "product_reference": "registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:e78a27a6a17ad3f2bd5771ada6ac2357156cd351dc3e976d0495fcdc38a4d891_ppc64le",
        "relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:bea6c0fb2bead67356a76060901018b90c2cda12e5ef0ffca8993e16b761ab41_arm64 as a component of Red Hat OpenShift distributed tracing 3.9.1",
          "product_id": "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:bea6c0fb2bead67356a76060901018b90c2cda12e5ef0ffca8993e16b761ab41_arm64"
        },
        "product_reference": "registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:bea6c0fb2bead67356a76060901018b90c2cda12e5ef0ffca8993e16b761ab41_arm64",
        "relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:cf73a80390a85a34b6b95a097a3e00c0ac5ed1e6e0bd396c1f55233b59de70ef_s390x as a component of Red Hat OpenShift distributed tracing 3.9.1",
          "product_id": "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:cf73a80390a85a34b6b95a097a3e00c0ac5ed1e6e0bd396c1f55233b59de70ef_s390x"
        },
        "product_reference": "registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:cf73a80390a85a34b6b95a097a3e00c0ac5ed1e6e0bd396c1f55233b59de70ef_s390x",
        "relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:d21b8336c12507aabdb03ecee43d5e93633b202ea880ae6aced0426b40d972f6_ppc64le as a component of Red Hat OpenShift distributed tracing 3.9.1",
          "product_id": "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:d21b8336c12507aabdb03ecee43d5e93633b202ea880ae6aced0426b40d972f6_ppc64le"
        },
        "product_reference": "registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:d21b8336c12507aabdb03ecee43d5e93633b202ea880ae6aced0426b40d972f6_ppc64le",
        "relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:f6e5c856ec74d0a7e858448960c4d09d2a24ac7bdce7ff18d1981bd23a45d6cb_amd64 as a component of Red Hat OpenShift distributed tracing 3.9.1",
          "product_id": "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:f6e5c856ec74d0a7e858448960c4d09d2a24ac7bdce7ff18d1981bd23a45d6cb_amd64"
        },
        "product_reference": "registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:f6e5c856ec74d0a7e858448960c4d09d2a24ac7bdce7ff18d1981bd23a45d6cb_amd64",
        "relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:9aca25cbc3ab1ba653d3b427df28f2b5ec1c4c041892e5e7ebd817be0ac56017_amd64 as a component of Red Hat OpenShift distributed tracing 3.9.1",
          "product_id": "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:9aca25cbc3ab1ba653d3b427df28f2b5ec1c4c041892e5e7ebd817be0ac56017_amd64"
        },
        "product_reference": "registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:9aca25cbc3ab1ba653d3b427df28f2b5ec1c4c041892e5e7ebd817be0ac56017_amd64",
        "relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:50bd4b1c745b916a8127a071e9d79dbde85268ab19c49ffb431863f9222152f6_ppc64le as a component of Red Hat OpenShift distributed tracing 3.9.1",
          "product_id": "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:50bd4b1c745b916a8127a071e9d79dbde85268ab19c49ffb431863f9222152f6_ppc64le"
        },
        "product_reference": "registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:50bd4b1c745b916a8127a071e9d79dbde85268ab19c49ffb431863f9222152f6_ppc64le",
        "relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:5e922a6dc5973688e531cb1bcbb7a9a414f260d64be9c0a66701b7c050f8ed65_s390x as a component of Red Hat OpenShift distributed tracing 3.9.1",
          "product_id": "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:5e922a6dc5973688e531cb1bcbb7a9a414f260d64be9c0a66701b7c050f8ed65_s390x"
        },
        "product_reference": "registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:5e922a6dc5973688e531cb1bcbb7a9a414f260d64be9c0a66701b7c050f8ed65_s390x",
        "relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:745c62848b8ab43bbcddf75a79b53662e0ac0aff050281c879e01c4c213accc3_amd64 as a component of Red Hat OpenShift distributed tracing 3.9.1",
          "product_id": "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:745c62848b8ab43bbcddf75a79b53662e0ac0aff050281c879e01c4c213accc3_amd64"
        },
        "product_reference": "registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:745c62848b8ab43bbcddf75a79b53662e0ac0aff050281c879e01c4c213accc3_amd64",
        "relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:d7c013a4088c668aacbc00047f00cb1cc0041676f9f8d5a9971ab53fd15d5a69_arm64 as a component of Red Hat OpenShift distributed tracing 3.9.1",
          "product_id": "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:d7c013a4088c668aacbc00047f00cb1cc0041676f9f8d5a9971ab53fd15d5a69_arm64"
        },
        "product_reference": "registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:d7c013a4088c668aacbc00047f00cb1cc0041676f9f8d5a9971ab53fd15d5a69_arm64",
        "relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0fd2089ab716a8733ccdaa909eb7d8663c69de0c87cfc6551ca5a7b93c295a7b_s390x as a component of Red Hat OpenShift distributed tracing 3.9.1",
          "product_id": "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0fd2089ab716a8733ccdaa909eb7d8663c69de0c87cfc6551ca5a7b93c295a7b_s390x"
        },
        "product_reference": "registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0fd2089ab716a8733ccdaa909eb7d8663c69de0c87cfc6551ca5a7b93c295a7b_s390x",
        "relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:815f222ec62bad59caede1682990af6367fcc4354013b5da96a7b67dd311a4b9_ppc64le as a component of Red Hat OpenShift distributed tracing 3.9.1",
          "product_id": "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:815f222ec62bad59caede1682990af6367fcc4354013b5da96a7b67dd311a4b9_ppc64le"
        },
        "product_reference": "registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:815f222ec62bad59caede1682990af6367fcc4354013b5da96a7b67dd311a4b9_ppc64le",
        "relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a12c6e4a54dfe009700be799c8036a09a8845bc84dea533c024ffac0a65dc491_arm64 as a component of Red Hat OpenShift distributed tracing 3.9.1",
          "product_id": "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a12c6e4a54dfe009700be799c8036a09a8845bc84dea533c024ffac0a65dc491_arm64"
        },
        "product_reference": "registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a12c6e4a54dfe009700be799c8036a09a8845bc84dea533c024ffac0a65dc491_arm64",
        "relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:e2c38ca7fa1257940589d6eace9ad5d95c6dbaccf36ae04ce296d0350258e0a0_amd64 as a component of Red Hat OpenShift distributed tracing 3.9.1",
          "product_id": "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:e2c38ca7fa1257940589d6eace9ad5d95c6dbaccf36ae04ce296d0350258e0a0_amd64"
        },
        "product_reference": "registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:e2c38ca7fa1257940589d6eace9ad5d95c6dbaccf36ae04ce296d0350258e0a0_amd64",
        "relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhosdt/tempo-rhel9@sha256:3345dc986a756c37e0636877a17dfa8483d12338e67d522419e85667f65cfa3e_arm64 as a component of Red Hat OpenShift distributed tracing 3.9.1",
          "product_id": "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:3345dc986a756c37e0636877a17dfa8483d12338e67d522419e85667f65cfa3e_arm64"
        },
        "product_reference": "registry.redhat.io/rhosdt/tempo-rhel9@sha256:3345dc986a756c37e0636877a17dfa8483d12338e67d522419e85667f65cfa3e_arm64",
        "relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhosdt/tempo-rhel9@sha256:5f227627f918d7a8b6328843da37547b54271ea93045b9a5d9ede82348b62d01_amd64 as a component of Red Hat OpenShift distributed tracing 3.9.1",
          "product_id": "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:5f227627f918d7a8b6328843da37547b54271ea93045b9a5d9ede82348b62d01_amd64"
        },
        "product_reference": "registry.redhat.io/rhosdt/tempo-rhel9@sha256:5f227627f918d7a8b6328843da37547b54271ea93045b9a5d9ede82348b62d01_amd64",
        "relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhosdt/tempo-rhel9@sha256:cb81f87ad3ed182494ec8f8f4d2a0229a28b716ae27f946d221077961534d9cc_ppc64le as a component of Red Hat OpenShift distributed tracing 3.9.1",
          "product_id": "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:cb81f87ad3ed182494ec8f8f4d2a0229a28b716ae27f946d221077961534d9cc_ppc64le"
        },
        "product_reference": "registry.redhat.io/rhosdt/tempo-rhel9@sha256:cb81f87ad3ed182494ec8f8f4d2a0229a28b716ae27f946d221077961534d9cc_ppc64le",
        "relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhosdt/tempo-rhel9@sha256:f9a90f6a24678435a08a9783ac7612629b0702633b9405540b02eb5a6da4c6c9_s390x as a component of Red Hat OpenShift distributed tracing 3.9.1",
          "product_id": "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:f9a90f6a24678435a08a9783ac7612629b0702633b9405540b02eb5a6da4c6c9_s390x"
        },
        "product_reference": "registry.redhat.io/rhosdt/tempo-rhel9@sha256:f9a90f6a24678435a08a9783ac7612629b0702633b9405540b02eb5a6da4c6c9_s390x",
        "relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.1"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-41602",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "discovery_date": "2026-04-28T10:01:16.099816+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:20951bbce71da848cf595ae1480a0c46b131b59190fd657774a8932889a8e5da_arm64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:37069c4ac61fc810096df8c25b1d12f95b04da5f11892fb4c6bcd3a3479d3777_amd64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:3bdaf268da97b95f85a09a18e42e2cfe61ee56b0131b6f86ac4a41fac4854650_s390x",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:94fa2f56d060b2ac8a384db29bf073683bef50cd60724e893ee1dcb945424517_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:58739fdf7b671103fddd089db340747090d46018435d2f6519fb00436f08684f_s390x",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:841e1897e543548f5494c9495463514d4286697a760326b67c11958933a7ac70_amd64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:d1a3996d3879700be89bad37bb688f5016078a11dbdda894932115da370508ee_arm64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:e78a27a6a17ad3f2bd5771ada6ac2357156cd351dc3e976d0495fcdc38a4d891_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:9aca25cbc3ab1ba653d3b427df28f2b5ec1c4c041892e5e7ebd817be0ac56017_amd64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0fd2089ab716a8733ccdaa909eb7d8663c69de0c87cfc6551ca5a7b93c295a7b_s390x",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:815f222ec62bad59caede1682990af6367fcc4354013b5da96a7b67dd311a4b9_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a12c6e4a54dfe009700be799c8036a09a8845bc84dea533c024ffac0a65dc491_arm64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:e2c38ca7fa1257940589d6eace9ad5d95c6dbaccf36ae04ce296d0350258e0a0_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2463407"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Apache Thrift TFramedTransport Go language implementation. This integer overflow or wraparound vulnerability could potentially allow an attacker to cause unexpected behavior or resource exhaustion, leading to a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "github.com/apache/thrift: Apache Thrift: Integer Overflow in TFramedTransport Go implementation",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:bea6c0fb2bead67356a76060901018b90c2cda12e5ef0ffca8993e16b761ab41_arm64",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:cf73a80390a85a34b6b95a097a3e00c0ac5ed1e6e0bd396c1f55233b59de70ef_s390x",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:d21b8336c12507aabdb03ecee43d5e93633b202ea880ae6aced0426b40d972f6_ppc64le",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:f6e5c856ec74d0a7e858448960c4d09d2a24ac7bdce7ff18d1981bd23a45d6cb_amd64",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:50bd4b1c745b916a8127a071e9d79dbde85268ab19c49ffb431863f9222152f6_ppc64le",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:5e922a6dc5973688e531cb1bcbb7a9a414f260d64be9c0a66701b7c050f8ed65_s390x",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:745c62848b8ab43bbcddf75a79b53662e0ac0aff050281c879e01c4c213accc3_amd64",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:d7c013a4088c668aacbc00047f00cb1cc0041676f9f8d5a9971ab53fd15d5a69_arm64",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:3345dc986a756c37e0636877a17dfa8483d12338e67d522419e85667f65cfa3e_arm64",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:5f227627f918d7a8b6328843da37547b54271ea93045b9a5d9ede82348b62d01_amd64",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:cb81f87ad3ed182494ec8f8f4d2a0229a28b716ae27f946d221077961534d9cc_ppc64le",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:f9a90f6a24678435a08a9783ac7612629b0702633b9405540b02eb5a6da4c6c9_s390x"
        ],
        "known_not_affected": [
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:20951bbce71da848cf595ae1480a0c46b131b59190fd657774a8932889a8e5da_arm64",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:37069c4ac61fc810096df8c25b1d12f95b04da5f11892fb4c6bcd3a3479d3777_amd64",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:3bdaf268da97b95f85a09a18e42e2cfe61ee56b0131b6f86ac4a41fac4854650_s390x",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:94fa2f56d060b2ac8a384db29bf073683bef50cd60724e893ee1dcb945424517_ppc64le",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:58739fdf7b671103fddd089db340747090d46018435d2f6519fb00436f08684f_s390x",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:841e1897e543548f5494c9495463514d4286697a760326b67c11958933a7ac70_amd64",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:d1a3996d3879700be89bad37bb688f5016078a11dbdda894932115da370508ee_arm64",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:e78a27a6a17ad3f2bd5771ada6ac2357156cd351dc3e976d0495fcdc38a4d891_ppc64le",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:9aca25cbc3ab1ba653d3b427df28f2b5ec1c4c041892e5e7ebd817be0ac56017_amd64",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0fd2089ab716a8733ccdaa909eb7d8663c69de0c87cfc6551ca5a7b93c295a7b_s390x",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:815f222ec62bad59caede1682990af6367fcc4354013b5da96a7b67dd311a4b9_ppc64le",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a12c6e4a54dfe009700be799c8036a09a8845bc84dea533c024ffac0a65dc491_arm64",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:e2c38ca7fa1257940589d6eace9ad5d95c6dbaccf36ae04ce296d0350258e0a0_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-41602"
        },
        {
          "category": "external",
          "summary": "RHBZ#2463407",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463407"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-41602",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-41602"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41602",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41602"
        },
        {
          "category": "external",
          "summary": "http://www.openwall.com/lists/oss-security/2026/04/28/6",
          "url": "http://www.openwall.com/lists/oss-security/2026/04/28/6"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql",
          "url": "https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql"
        }
      ],
      "release_date": "2026-04-28T09:19:06.646000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-07T16:23:20+00:00",
          "details": "For details on how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators",
          "product_ids": [
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:bea6c0fb2bead67356a76060901018b90c2cda12e5ef0ffca8993e16b761ab41_arm64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:cf73a80390a85a34b6b95a097a3e00c0ac5ed1e6e0bd396c1f55233b59de70ef_s390x",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:d21b8336c12507aabdb03ecee43d5e93633b202ea880ae6aced0426b40d972f6_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:f6e5c856ec74d0a7e858448960c4d09d2a24ac7bdce7ff18d1981bd23a45d6cb_amd64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:50bd4b1c745b916a8127a071e9d79dbde85268ab19c49ffb431863f9222152f6_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:5e922a6dc5973688e531cb1bcbb7a9a414f260d64be9c0a66701b7c050f8ed65_s390x",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:745c62848b8ab43bbcddf75a79b53662e0ac0aff050281c879e01c4c213accc3_amd64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:d7c013a4088c668aacbc00047f00cb1cc0041676f9f8d5a9971ab53fd15d5a69_arm64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:3345dc986a756c37e0636877a17dfa8483d12338e67d522419e85667f65cfa3e_arm64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:5f227627f918d7a8b6328843da37547b54271ea93045b9a5d9ede82348b62d01_amd64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:cb81f87ad3ed182494ec8f8f4d2a0229a28b716ae27f946d221077961534d9cc_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:f9a90f6a24678435a08a9783ac7612629b0702633b9405540b02eb5a6da4c6c9_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:14885"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:20951bbce71da848cf595ae1480a0c46b131b59190fd657774a8932889a8e5da_arm64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:37069c4ac61fc810096df8c25b1d12f95b04da5f11892fb4c6bcd3a3479d3777_amd64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:3bdaf268da97b95f85a09a18e42e2cfe61ee56b0131b6f86ac4a41fac4854650_s390x",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:94fa2f56d060b2ac8a384db29bf073683bef50cd60724e893ee1dcb945424517_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:58739fdf7b671103fddd089db340747090d46018435d2f6519fb00436f08684f_s390x",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:841e1897e543548f5494c9495463514d4286697a760326b67c11958933a7ac70_amd64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:d1a3996d3879700be89bad37bb688f5016078a11dbdda894932115da370508ee_arm64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:e78a27a6a17ad3f2bd5771ada6ac2357156cd351dc3e976d0495fcdc38a4d891_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:bea6c0fb2bead67356a76060901018b90c2cda12e5ef0ffca8993e16b761ab41_arm64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:cf73a80390a85a34b6b95a097a3e00c0ac5ed1e6e0bd396c1f55233b59de70ef_s390x",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:d21b8336c12507aabdb03ecee43d5e93633b202ea880ae6aced0426b40d972f6_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:f6e5c856ec74d0a7e858448960c4d09d2a24ac7bdce7ff18d1981bd23a45d6cb_amd64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:9aca25cbc3ab1ba653d3b427df28f2b5ec1c4c041892e5e7ebd817be0ac56017_amd64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:50bd4b1c745b916a8127a071e9d79dbde85268ab19c49ffb431863f9222152f6_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:5e922a6dc5973688e531cb1bcbb7a9a414f260d64be9c0a66701b7c050f8ed65_s390x",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:745c62848b8ab43bbcddf75a79b53662e0ac0aff050281c879e01c4c213accc3_amd64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:d7c013a4088c668aacbc00047f00cb1cc0041676f9f8d5a9971ab53fd15d5a69_arm64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0fd2089ab716a8733ccdaa909eb7d8663c69de0c87cfc6551ca5a7b93c295a7b_s390x",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:815f222ec62bad59caede1682990af6367fcc4354013b5da96a7b67dd311a4b9_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a12c6e4a54dfe009700be799c8036a09a8845bc84dea533c024ffac0a65dc491_arm64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:e2c38ca7fa1257940589d6eace9ad5d95c6dbaccf36ae04ce296d0350258e0a0_amd64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:3345dc986a756c37e0636877a17dfa8483d12338e67d522419e85667f65cfa3e_arm64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:5f227627f918d7a8b6328843da37547b54271ea93045b9a5d9ede82348b62d01_amd64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:cb81f87ad3ed182494ec8f8f4d2a0229a28b716ae27f946d221077961534d9cc_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:f9a90f6a24678435a08a9783ac7612629b0702633b9405540b02eb5a6da4c6c9_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "github.com/apache/thrift: Apache Thrift: Integer Overflow in TFramedTransport Go implementation"
    },
    {
      "cve": "CVE-2026-41603",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "discovery_date": "2026-04-28T10:01:29.782287+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:20951bbce71da848cf595ae1480a0c46b131b59190fd657774a8932889a8e5da_arm64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:37069c4ac61fc810096df8c25b1d12f95b04da5f11892fb4c6bcd3a3479d3777_amd64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:3bdaf268da97b95f85a09a18e42e2cfe61ee56b0131b6f86ac4a41fac4854650_s390x",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:94fa2f56d060b2ac8a384db29bf073683bef50cd60724e893ee1dcb945424517_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:58739fdf7b671103fddd089db340747090d46018435d2f6519fb00436f08684f_s390x",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:841e1897e543548f5494c9495463514d4286697a760326b67c11958933a7ac70_amd64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:d1a3996d3879700be89bad37bb688f5016078a11dbdda894932115da370508ee_arm64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:e78a27a6a17ad3f2bd5771ada6ac2357156cd351dc3e976d0495fcdc38a4d891_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:9aca25cbc3ab1ba653d3b427df28f2b5ec1c4c041892e5e7ebd817be0ac56017_amd64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0fd2089ab716a8733ccdaa909eb7d8663c69de0c87cfc6551ca5a7b93c295a7b_s390x",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:815f222ec62bad59caede1682990af6367fcc4354013b5da96a7b67dd311a4b9_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a12c6e4a54dfe009700be799c8036a09a8845bc84dea533c024ffac0a65dc491_arm64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:e2c38ca7fa1257940589d6eace9ad5d95c6dbaccf36ae04ce296d0350258e0a0_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2463411"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache Thrift. This vulnerability involves improper validation of server certificates, where the hostname presented in the certificate does not match the expected hostname. A remote attacker could exploit this to impersonate a legitimate server, potentially intercepting or altering sensitive communications and leading to unauthorized access or information disclosure.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Apache Thrift: apache.com/apache/thrift: Apache Thrift: Security Bypass via Improper Certificate Hostname Validation",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:bea6c0fb2bead67356a76060901018b90c2cda12e5ef0ffca8993e16b761ab41_arm64",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:cf73a80390a85a34b6b95a097a3e00c0ac5ed1e6e0bd396c1f55233b59de70ef_s390x",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:d21b8336c12507aabdb03ecee43d5e93633b202ea880ae6aced0426b40d972f6_ppc64le",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:f6e5c856ec74d0a7e858448960c4d09d2a24ac7bdce7ff18d1981bd23a45d6cb_amd64",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:50bd4b1c745b916a8127a071e9d79dbde85268ab19c49ffb431863f9222152f6_ppc64le",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:5e922a6dc5973688e531cb1bcbb7a9a414f260d64be9c0a66701b7c050f8ed65_s390x",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:745c62848b8ab43bbcddf75a79b53662e0ac0aff050281c879e01c4c213accc3_amd64",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:d7c013a4088c668aacbc00047f00cb1cc0041676f9f8d5a9971ab53fd15d5a69_arm64",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:3345dc986a756c37e0636877a17dfa8483d12338e67d522419e85667f65cfa3e_arm64",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:5f227627f918d7a8b6328843da37547b54271ea93045b9a5d9ede82348b62d01_amd64",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:cb81f87ad3ed182494ec8f8f4d2a0229a28b716ae27f946d221077961534d9cc_ppc64le",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:f9a90f6a24678435a08a9783ac7612629b0702633b9405540b02eb5a6da4c6c9_s390x"
        ],
        "known_not_affected": [
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:20951bbce71da848cf595ae1480a0c46b131b59190fd657774a8932889a8e5da_arm64",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:37069c4ac61fc810096df8c25b1d12f95b04da5f11892fb4c6bcd3a3479d3777_amd64",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:3bdaf268da97b95f85a09a18e42e2cfe61ee56b0131b6f86ac4a41fac4854650_s390x",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:94fa2f56d060b2ac8a384db29bf073683bef50cd60724e893ee1dcb945424517_ppc64le",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:58739fdf7b671103fddd089db340747090d46018435d2f6519fb00436f08684f_s390x",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:841e1897e543548f5494c9495463514d4286697a760326b67c11958933a7ac70_amd64",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:d1a3996d3879700be89bad37bb688f5016078a11dbdda894932115da370508ee_arm64",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:e78a27a6a17ad3f2bd5771ada6ac2357156cd351dc3e976d0495fcdc38a4d891_ppc64le",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:9aca25cbc3ab1ba653d3b427df28f2b5ec1c4c041892e5e7ebd817be0ac56017_amd64",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0fd2089ab716a8733ccdaa909eb7d8663c69de0c87cfc6551ca5a7b93c295a7b_s390x",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:815f222ec62bad59caede1682990af6367fcc4354013b5da96a7b67dd311a4b9_ppc64le",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a12c6e4a54dfe009700be799c8036a09a8845bc84dea533c024ffac0a65dc491_arm64",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:e2c38ca7fa1257940589d6eace9ad5d95c6dbaccf36ae04ce296d0350258e0a0_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-41603"
        },
        {
          "category": "external",
          "summary": "RHBZ#2463411",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463411"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-41603",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-41603"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41603",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41603"
        },
        {
          "category": "external",
          "summary": "http://www.openwall.com/lists/oss-security/2026/04/28/7",
          "url": "http://www.openwall.com/lists/oss-security/2026/04/28/7"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql",
          "url": "https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql"
        }
      ],
      "release_date": "2026-04-28T09:19:40.564000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-07T16:23:20+00:00",
          "details": "For details on how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators",
          "product_ids": [
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:bea6c0fb2bead67356a76060901018b90c2cda12e5ef0ffca8993e16b761ab41_arm64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:cf73a80390a85a34b6b95a097a3e00c0ac5ed1e6e0bd396c1f55233b59de70ef_s390x",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:d21b8336c12507aabdb03ecee43d5e93633b202ea880ae6aced0426b40d972f6_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:f6e5c856ec74d0a7e858448960c4d09d2a24ac7bdce7ff18d1981bd23a45d6cb_amd64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:50bd4b1c745b916a8127a071e9d79dbde85268ab19c49ffb431863f9222152f6_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:5e922a6dc5973688e531cb1bcbb7a9a414f260d64be9c0a66701b7c050f8ed65_s390x",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:745c62848b8ab43bbcddf75a79b53662e0ac0aff050281c879e01c4c213accc3_amd64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:d7c013a4088c668aacbc00047f00cb1cc0041676f9f8d5a9971ab53fd15d5a69_arm64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:3345dc986a756c37e0636877a17dfa8483d12338e67d522419e85667f65cfa3e_arm64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:5f227627f918d7a8b6328843da37547b54271ea93045b9a5d9ede82348b62d01_amd64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:cb81f87ad3ed182494ec8f8f4d2a0229a28b716ae27f946d221077961534d9cc_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:f9a90f6a24678435a08a9783ac7612629b0702633b9405540b02eb5a6da4c6c9_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:14885"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:20951bbce71da848cf595ae1480a0c46b131b59190fd657774a8932889a8e5da_arm64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:37069c4ac61fc810096df8c25b1d12f95b04da5f11892fb4c6bcd3a3479d3777_amd64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:3bdaf268da97b95f85a09a18e42e2cfe61ee56b0131b6f86ac4a41fac4854650_s390x",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:94fa2f56d060b2ac8a384db29bf073683bef50cd60724e893ee1dcb945424517_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:58739fdf7b671103fddd089db340747090d46018435d2f6519fb00436f08684f_s390x",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:841e1897e543548f5494c9495463514d4286697a760326b67c11958933a7ac70_amd64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:d1a3996d3879700be89bad37bb688f5016078a11dbdda894932115da370508ee_arm64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:e78a27a6a17ad3f2bd5771ada6ac2357156cd351dc3e976d0495fcdc38a4d891_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:bea6c0fb2bead67356a76060901018b90c2cda12e5ef0ffca8993e16b761ab41_arm64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:cf73a80390a85a34b6b95a097a3e00c0ac5ed1e6e0bd396c1f55233b59de70ef_s390x",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:d21b8336c12507aabdb03ecee43d5e93633b202ea880ae6aced0426b40d972f6_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:f6e5c856ec74d0a7e858448960c4d09d2a24ac7bdce7ff18d1981bd23a45d6cb_amd64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:9aca25cbc3ab1ba653d3b427df28f2b5ec1c4c041892e5e7ebd817be0ac56017_amd64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:50bd4b1c745b916a8127a071e9d79dbde85268ab19c49ffb431863f9222152f6_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:5e922a6dc5973688e531cb1bcbb7a9a414f260d64be9c0a66701b7c050f8ed65_s390x",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:745c62848b8ab43bbcddf75a79b53662e0ac0aff050281c879e01c4c213accc3_amd64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:d7c013a4088c668aacbc00047f00cb1cc0041676f9f8d5a9971ab53fd15d5a69_arm64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0fd2089ab716a8733ccdaa909eb7d8663c69de0c87cfc6551ca5a7b93c295a7b_s390x",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:815f222ec62bad59caede1682990af6367fcc4354013b5da96a7b67dd311a4b9_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a12c6e4a54dfe009700be799c8036a09a8845bc84dea533c024ffac0a65dc491_arm64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:e2c38ca7fa1257940589d6eace9ad5d95c6dbaccf36ae04ce296d0350258e0a0_amd64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:3345dc986a756c37e0636877a17dfa8483d12338e67d522419e85667f65cfa3e_arm64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:5f227627f918d7a8b6328843da37547b54271ea93045b9a5d9ede82348b62d01_amd64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:cb81f87ad3ed182494ec8f8f4d2a0229a28b716ae27f946d221077961534d9cc_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:f9a90f6a24678435a08a9783ac7612629b0702633b9405540b02eb5a6da4c6c9_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "Apache Thrift: apache.com/apache/thrift: Apache Thrift: Security Bypass via Improper Certificate Hostname Validation"
    },
    {
      "cve": "CVE-2026-41604",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2026-04-28T10:01:47.903741+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:20951bbce71da848cf595ae1480a0c46b131b59190fd657774a8932889a8e5da_arm64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:37069c4ac61fc810096df8c25b1d12f95b04da5f11892fb4c6bcd3a3479d3777_amd64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:3bdaf268da97b95f85a09a18e42e2cfe61ee56b0131b6f86ac4a41fac4854650_s390x",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:94fa2f56d060b2ac8a384db29bf073683bef50cd60724e893ee1dcb945424517_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:58739fdf7b671103fddd089db340747090d46018435d2f6519fb00436f08684f_s390x",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:841e1897e543548f5494c9495463514d4286697a760326b67c11958933a7ac70_amd64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:d1a3996d3879700be89bad37bb688f5016078a11dbdda894932115da370508ee_arm64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:e78a27a6a17ad3f2bd5771ada6ac2357156cd351dc3e976d0495fcdc38a4d891_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:9aca25cbc3ab1ba653d3b427df28f2b5ec1c4c041892e5e7ebd817be0ac56017_amd64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0fd2089ab716a8733ccdaa909eb7d8663c69de0c87cfc6551ca5a7b93c295a7b_s390x",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:815f222ec62bad59caede1682990af6367fcc4354013b5da96a7b67dd311a4b9_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a12c6e4a54dfe009700be799c8036a09a8845bc84dea533c024ffac0a65dc491_arm64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:e2c38ca7fa1257940589d6eace9ad5d95c6dbaccf36ae04ce296d0350258e0a0_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2463416"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache Thrift. This out-of-bounds read vulnerability could allow an attacker to access memory outside of allocated bounds. This could lead to information disclosure or potentially a denial of service (DoS) condition.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Apache Thrift: apache.com/apache/thrift: Apache Thrift: Out-of-bounds Read vulnerability",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:bea6c0fb2bead67356a76060901018b90c2cda12e5ef0ffca8993e16b761ab41_arm64",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:cf73a80390a85a34b6b95a097a3e00c0ac5ed1e6e0bd396c1f55233b59de70ef_s390x",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:d21b8336c12507aabdb03ecee43d5e93633b202ea880ae6aced0426b40d972f6_ppc64le",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:f6e5c856ec74d0a7e858448960c4d09d2a24ac7bdce7ff18d1981bd23a45d6cb_amd64",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:50bd4b1c745b916a8127a071e9d79dbde85268ab19c49ffb431863f9222152f6_ppc64le",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:5e922a6dc5973688e531cb1bcbb7a9a414f260d64be9c0a66701b7c050f8ed65_s390x",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:745c62848b8ab43bbcddf75a79b53662e0ac0aff050281c879e01c4c213accc3_amd64",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:d7c013a4088c668aacbc00047f00cb1cc0041676f9f8d5a9971ab53fd15d5a69_arm64",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:3345dc986a756c37e0636877a17dfa8483d12338e67d522419e85667f65cfa3e_arm64",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:5f227627f918d7a8b6328843da37547b54271ea93045b9a5d9ede82348b62d01_amd64",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:cb81f87ad3ed182494ec8f8f4d2a0229a28b716ae27f946d221077961534d9cc_ppc64le",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:f9a90f6a24678435a08a9783ac7612629b0702633b9405540b02eb5a6da4c6c9_s390x"
        ],
        "known_not_affected": [
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:20951bbce71da848cf595ae1480a0c46b131b59190fd657774a8932889a8e5da_arm64",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:37069c4ac61fc810096df8c25b1d12f95b04da5f11892fb4c6bcd3a3479d3777_amd64",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:3bdaf268da97b95f85a09a18e42e2cfe61ee56b0131b6f86ac4a41fac4854650_s390x",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:94fa2f56d060b2ac8a384db29bf073683bef50cd60724e893ee1dcb945424517_ppc64le",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:58739fdf7b671103fddd089db340747090d46018435d2f6519fb00436f08684f_s390x",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:841e1897e543548f5494c9495463514d4286697a760326b67c11958933a7ac70_amd64",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:d1a3996d3879700be89bad37bb688f5016078a11dbdda894932115da370508ee_arm64",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:e78a27a6a17ad3f2bd5771ada6ac2357156cd351dc3e976d0495fcdc38a4d891_ppc64le",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:9aca25cbc3ab1ba653d3b427df28f2b5ec1c4c041892e5e7ebd817be0ac56017_amd64",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0fd2089ab716a8733ccdaa909eb7d8663c69de0c87cfc6551ca5a7b93c295a7b_s390x",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:815f222ec62bad59caede1682990af6367fcc4354013b5da96a7b67dd311a4b9_ppc64le",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a12c6e4a54dfe009700be799c8036a09a8845bc84dea533c024ffac0a65dc491_arm64",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:e2c38ca7fa1257940589d6eace9ad5d95c6dbaccf36ae04ce296d0350258e0a0_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-41604"
        },
        {
          "category": "external",
          "summary": "RHBZ#2463416",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463416"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-41604",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-41604"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41604",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41604"
        },
        {
          "category": "external",
          "summary": "http://www.openwall.com/lists/oss-security/2026/04/28/5",
          "url": "http://www.openwall.com/lists/oss-security/2026/04/28/5"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql",
          "url": "https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql"
        }
      ],
      "release_date": "2026-04-28T09:20:13.996000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-07T16:23:20+00:00",
          "details": "For details on how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators",
          "product_ids": [
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:bea6c0fb2bead67356a76060901018b90c2cda12e5ef0ffca8993e16b761ab41_arm64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:cf73a80390a85a34b6b95a097a3e00c0ac5ed1e6e0bd396c1f55233b59de70ef_s390x",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:d21b8336c12507aabdb03ecee43d5e93633b202ea880ae6aced0426b40d972f6_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:f6e5c856ec74d0a7e858448960c4d09d2a24ac7bdce7ff18d1981bd23a45d6cb_amd64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:50bd4b1c745b916a8127a071e9d79dbde85268ab19c49ffb431863f9222152f6_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:5e922a6dc5973688e531cb1bcbb7a9a414f260d64be9c0a66701b7c050f8ed65_s390x",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:745c62848b8ab43bbcddf75a79b53662e0ac0aff050281c879e01c4c213accc3_amd64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:d7c013a4088c668aacbc00047f00cb1cc0041676f9f8d5a9971ab53fd15d5a69_arm64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:3345dc986a756c37e0636877a17dfa8483d12338e67d522419e85667f65cfa3e_arm64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:5f227627f918d7a8b6328843da37547b54271ea93045b9a5d9ede82348b62d01_amd64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:cb81f87ad3ed182494ec8f8f4d2a0229a28b716ae27f946d221077961534d9cc_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:f9a90f6a24678435a08a9783ac7612629b0702633b9405540b02eb5a6da4c6c9_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:14885"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:20951bbce71da848cf595ae1480a0c46b131b59190fd657774a8932889a8e5da_arm64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:37069c4ac61fc810096df8c25b1d12f95b04da5f11892fb4c6bcd3a3479d3777_amd64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:3bdaf268da97b95f85a09a18e42e2cfe61ee56b0131b6f86ac4a41fac4854650_s390x",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:94fa2f56d060b2ac8a384db29bf073683bef50cd60724e893ee1dcb945424517_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:58739fdf7b671103fddd089db340747090d46018435d2f6519fb00436f08684f_s390x",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:841e1897e543548f5494c9495463514d4286697a760326b67c11958933a7ac70_amd64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:d1a3996d3879700be89bad37bb688f5016078a11dbdda894932115da370508ee_arm64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:e78a27a6a17ad3f2bd5771ada6ac2357156cd351dc3e976d0495fcdc38a4d891_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:bea6c0fb2bead67356a76060901018b90c2cda12e5ef0ffca8993e16b761ab41_arm64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:cf73a80390a85a34b6b95a097a3e00c0ac5ed1e6e0bd396c1f55233b59de70ef_s390x",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:d21b8336c12507aabdb03ecee43d5e93633b202ea880ae6aced0426b40d972f6_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:f6e5c856ec74d0a7e858448960c4d09d2a24ac7bdce7ff18d1981bd23a45d6cb_amd64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:9aca25cbc3ab1ba653d3b427df28f2b5ec1c4c041892e5e7ebd817be0ac56017_amd64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:50bd4b1c745b916a8127a071e9d79dbde85268ab19c49ffb431863f9222152f6_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:5e922a6dc5973688e531cb1bcbb7a9a414f260d64be9c0a66701b7c050f8ed65_s390x",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:745c62848b8ab43bbcddf75a79b53662e0ac0aff050281c879e01c4c213accc3_amd64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:d7c013a4088c668aacbc00047f00cb1cc0041676f9f8d5a9971ab53fd15d5a69_arm64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0fd2089ab716a8733ccdaa909eb7d8663c69de0c87cfc6551ca5a7b93c295a7b_s390x",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:815f222ec62bad59caede1682990af6367fcc4354013b5da96a7b67dd311a4b9_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a12c6e4a54dfe009700be799c8036a09a8845bc84dea533c024ffac0a65dc491_arm64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:e2c38ca7fa1257940589d6eace9ad5d95c6dbaccf36ae04ce296d0350258e0a0_amd64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:3345dc986a756c37e0636877a17dfa8483d12338e67d522419e85667f65cfa3e_arm64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:5f227627f918d7a8b6328843da37547b54271ea93045b9a5d9ede82348b62d01_amd64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:cb81f87ad3ed182494ec8f8f4d2a0229a28b716ae27f946d221077961534d9cc_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:f9a90f6a24678435a08a9783ac7612629b0702633b9405540b02eb5a6da4c6c9_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "Apache Thrift: apache.com/apache/thrift: Apache Thrift: Out-of-bounds Read vulnerability"
    },
    {
      "cve": "CVE-2026-41605",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "discovery_date": "2026-04-28T10:01:54.269412+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:20951bbce71da848cf595ae1480a0c46b131b59190fd657774a8932889a8e5da_arm64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:37069c4ac61fc810096df8c25b1d12f95b04da5f11892fb4c6bcd3a3479d3777_amd64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:3bdaf268da97b95f85a09a18e42e2cfe61ee56b0131b6f86ac4a41fac4854650_s390x",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:94fa2f56d060b2ac8a384db29bf073683bef50cd60724e893ee1dcb945424517_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:58739fdf7b671103fddd089db340747090d46018435d2f6519fb00436f08684f_s390x",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:841e1897e543548f5494c9495463514d4286697a760326b67c11958933a7ac70_amd64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:d1a3996d3879700be89bad37bb688f5016078a11dbdda894932115da370508ee_arm64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:e78a27a6a17ad3f2bd5771ada6ac2357156cd351dc3e976d0495fcdc38a4d891_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:9aca25cbc3ab1ba653d3b427df28f2b5ec1c4c041892e5e7ebd817be0ac56017_amd64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0fd2089ab716a8733ccdaa909eb7d8663c69de0c87cfc6551ca5a7b93c295a7b_s390x",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:815f222ec62bad59caede1682990af6367fcc4354013b5da96a7b67dd311a4b9_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a12c6e4a54dfe009700be799c8036a09a8845bc84dea533c024ffac0a65dc491_arm64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:e2c38ca7fa1257940589d6eace9ad5d95c6dbaccf36ae04ce296d0350258e0a0_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2463418"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache Thrift. This integer overflow or wraparound vulnerability could potentially lead to unexpected behavior or resource exhaustion, which may impact the availability or integrity of the system. The exact consequences depend on how the overflow is triggered and handled within the application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Apache Thrift: Apache Thrift: Integer Overflow or Wraparound Vulnerability",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:bea6c0fb2bead67356a76060901018b90c2cda12e5ef0ffca8993e16b761ab41_arm64",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:cf73a80390a85a34b6b95a097a3e00c0ac5ed1e6e0bd396c1f55233b59de70ef_s390x",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:d21b8336c12507aabdb03ecee43d5e93633b202ea880ae6aced0426b40d972f6_ppc64le",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:f6e5c856ec74d0a7e858448960c4d09d2a24ac7bdce7ff18d1981bd23a45d6cb_amd64",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:50bd4b1c745b916a8127a071e9d79dbde85268ab19c49ffb431863f9222152f6_ppc64le",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:5e922a6dc5973688e531cb1bcbb7a9a414f260d64be9c0a66701b7c050f8ed65_s390x",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:745c62848b8ab43bbcddf75a79b53662e0ac0aff050281c879e01c4c213accc3_amd64",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:d7c013a4088c668aacbc00047f00cb1cc0041676f9f8d5a9971ab53fd15d5a69_arm64",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:3345dc986a756c37e0636877a17dfa8483d12338e67d522419e85667f65cfa3e_arm64",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:5f227627f918d7a8b6328843da37547b54271ea93045b9a5d9ede82348b62d01_amd64",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:cb81f87ad3ed182494ec8f8f4d2a0229a28b716ae27f946d221077961534d9cc_ppc64le",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:f9a90f6a24678435a08a9783ac7612629b0702633b9405540b02eb5a6da4c6c9_s390x"
        ],
        "known_not_affected": [
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:20951bbce71da848cf595ae1480a0c46b131b59190fd657774a8932889a8e5da_arm64",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:37069c4ac61fc810096df8c25b1d12f95b04da5f11892fb4c6bcd3a3479d3777_amd64",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:3bdaf268da97b95f85a09a18e42e2cfe61ee56b0131b6f86ac4a41fac4854650_s390x",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:94fa2f56d060b2ac8a384db29bf073683bef50cd60724e893ee1dcb945424517_ppc64le",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:58739fdf7b671103fddd089db340747090d46018435d2f6519fb00436f08684f_s390x",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:841e1897e543548f5494c9495463514d4286697a760326b67c11958933a7ac70_amd64",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:d1a3996d3879700be89bad37bb688f5016078a11dbdda894932115da370508ee_arm64",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:e78a27a6a17ad3f2bd5771ada6ac2357156cd351dc3e976d0495fcdc38a4d891_ppc64le",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:9aca25cbc3ab1ba653d3b427df28f2b5ec1c4c041892e5e7ebd817be0ac56017_amd64",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0fd2089ab716a8733ccdaa909eb7d8663c69de0c87cfc6551ca5a7b93c295a7b_s390x",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:815f222ec62bad59caede1682990af6367fcc4354013b5da96a7b67dd311a4b9_ppc64le",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a12c6e4a54dfe009700be799c8036a09a8845bc84dea533c024ffac0a65dc491_arm64",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:e2c38ca7fa1257940589d6eace9ad5d95c6dbaccf36ae04ce296d0350258e0a0_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-41605"
        },
        {
          "category": "external",
          "summary": "RHBZ#2463418",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463418"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-41605",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-41605"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41605",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41605"
        },
        {
          "category": "external",
          "summary": "http://www.openwall.com/lists/oss-security/2026/04/28/4",
          "url": "http://www.openwall.com/lists/oss-security/2026/04/28/4"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql",
          "url": "https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql"
        }
      ],
      "release_date": "2026-04-28T09:20:44.319000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-07T16:23:20+00:00",
          "details": "For details on how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators",
          "product_ids": [
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:bea6c0fb2bead67356a76060901018b90c2cda12e5ef0ffca8993e16b761ab41_arm64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:cf73a80390a85a34b6b95a097a3e00c0ac5ed1e6e0bd396c1f55233b59de70ef_s390x",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:d21b8336c12507aabdb03ecee43d5e93633b202ea880ae6aced0426b40d972f6_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:f6e5c856ec74d0a7e858448960c4d09d2a24ac7bdce7ff18d1981bd23a45d6cb_amd64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:50bd4b1c745b916a8127a071e9d79dbde85268ab19c49ffb431863f9222152f6_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:5e922a6dc5973688e531cb1bcbb7a9a414f260d64be9c0a66701b7c050f8ed65_s390x",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:745c62848b8ab43bbcddf75a79b53662e0ac0aff050281c879e01c4c213accc3_amd64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:d7c013a4088c668aacbc00047f00cb1cc0041676f9f8d5a9971ab53fd15d5a69_arm64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:3345dc986a756c37e0636877a17dfa8483d12338e67d522419e85667f65cfa3e_arm64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:5f227627f918d7a8b6328843da37547b54271ea93045b9a5d9ede82348b62d01_amd64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:cb81f87ad3ed182494ec8f8f4d2a0229a28b716ae27f946d221077961534d9cc_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:f9a90f6a24678435a08a9783ac7612629b0702633b9405540b02eb5a6da4c6c9_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:14885"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:20951bbce71da848cf595ae1480a0c46b131b59190fd657774a8932889a8e5da_arm64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:37069c4ac61fc810096df8c25b1d12f95b04da5f11892fb4c6bcd3a3479d3777_amd64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:3bdaf268da97b95f85a09a18e42e2cfe61ee56b0131b6f86ac4a41fac4854650_s390x",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:94fa2f56d060b2ac8a384db29bf073683bef50cd60724e893ee1dcb945424517_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:58739fdf7b671103fddd089db340747090d46018435d2f6519fb00436f08684f_s390x",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:841e1897e543548f5494c9495463514d4286697a760326b67c11958933a7ac70_amd64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:d1a3996d3879700be89bad37bb688f5016078a11dbdda894932115da370508ee_arm64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:e78a27a6a17ad3f2bd5771ada6ac2357156cd351dc3e976d0495fcdc38a4d891_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:bea6c0fb2bead67356a76060901018b90c2cda12e5ef0ffca8993e16b761ab41_arm64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:cf73a80390a85a34b6b95a097a3e00c0ac5ed1e6e0bd396c1f55233b59de70ef_s390x",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:d21b8336c12507aabdb03ecee43d5e93633b202ea880ae6aced0426b40d972f6_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:f6e5c856ec74d0a7e858448960c4d09d2a24ac7bdce7ff18d1981bd23a45d6cb_amd64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:9aca25cbc3ab1ba653d3b427df28f2b5ec1c4c041892e5e7ebd817be0ac56017_amd64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:50bd4b1c745b916a8127a071e9d79dbde85268ab19c49ffb431863f9222152f6_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:5e922a6dc5973688e531cb1bcbb7a9a414f260d64be9c0a66701b7c050f8ed65_s390x",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:745c62848b8ab43bbcddf75a79b53662e0ac0aff050281c879e01c4c213accc3_amd64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:d7c013a4088c668aacbc00047f00cb1cc0041676f9f8d5a9971ab53fd15d5a69_arm64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0fd2089ab716a8733ccdaa909eb7d8663c69de0c87cfc6551ca5a7b93c295a7b_s390x",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:815f222ec62bad59caede1682990af6367fcc4354013b5da96a7b67dd311a4b9_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a12c6e4a54dfe009700be799c8036a09a8845bc84dea533c024ffac0a65dc491_arm64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:e2c38ca7fa1257940589d6eace9ad5d95c6dbaccf36ae04ce296d0350258e0a0_amd64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:3345dc986a756c37e0636877a17dfa8483d12338e67d522419e85667f65cfa3e_arm64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:5f227627f918d7a8b6328843da37547b54271ea93045b9a5d9ede82348b62d01_amd64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:cb81f87ad3ed182494ec8f8f4d2a0229a28b716ae27f946d221077961534d9cc_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:f9a90f6a24678435a08a9783ac7612629b0702633b9405540b02eb5a6da4c6c9_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "Apache Thrift: Apache Thrift: Integer Overflow or Wraparound Vulnerability"
    },
    {
      "cve": "CVE-2026-41606",
      "cwe": {
        "id": "CWE-606",
        "name": "Unchecked Input for Loop Condition"
      },
      "discovery_date": "2026-04-28T10:01:19.136351+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:20951bbce71da848cf595ae1480a0c46b131b59190fd657774a8932889a8e5da_arm64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:37069c4ac61fc810096df8c25b1d12f95b04da5f11892fb4c6bcd3a3479d3777_amd64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:3bdaf268da97b95f85a09a18e42e2cfe61ee56b0131b6f86ac4a41fac4854650_s390x",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:94fa2f56d060b2ac8a384db29bf073683bef50cd60724e893ee1dcb945424517_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:58739fdf7b671103fddd089db340747090d46018435d2f6519fb00436f08684f_s390x",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:841e1897e543548f5494c9495463514d4286697a760326b67c11958933a7ac70_amd64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:d1a3996d3879700be89bad37bb688f5016078a11dbdda894932115da370508ee_arm64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:e78a27a6a17ad3f2bd5771ada6ac2357156cd351dc3e976d0495fcdc38a4d891_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:9aca25cbc3ab1ba653d3b427df28f2b5ec1c4c041892e5e7ebd817be0ac56017_amd64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0fd2089ab716a8733ccdaa909eb7d8663c69de0c87cfc6551ca5a7b93c295a7b_s390x",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:815f222ec62bad59caede1682990af6367fcc4354013b5da96a7b67dd311a4b9_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a12c6e4a54dfe009700be799c8036a09a8845bc84dea533c024ffac0a65dc491_arm64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:e2c38ca7fa1257940589d6eace9ad5d95c6dbaccf36ae04ce296d0350258e0a0_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2463408"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache Thrift. An uncontrolled recursion vulnerability exists, which could allow a remote attacker to trigger a Denial of Service (DoS) condition. This occurs when the affected component processes specially crafted input, leading to excessive resource consumption and system unavailability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Apache Thrift: Apache Thrift: Denial of Service via uncontrolled recursion",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:bea6c0fb2bead67356a76060901018b90c2cda12e5ef0ffca8993e16b761ab41_arm64",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:cf73a80390a85a34b6b95a097a3e00c0ac5ed1e6e0bd396c1f55233b59de70ef_s390x",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:d21b8336c12507aabdb03ecee43d5e93633b202ea880ae6aced0426b40d972f6_ppc64le",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:f6e5c856ec74d0a7e858448960c4d09d2a24ac7bdce7ff18d1981bd23a45d6cb_amd64",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:50bd4b1c745b916a8127a071e9d79dbde85268ab19c49ffb431863f9222152f6_ppc64le",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:5e922a6dc5973688e531cb1bcbb7a9a414f260d64be9c0a66701b7c050f8ed65_s390x",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:745c62848b8ab43bbcddf75a79b53662e0ac0aff050281c879e01c4c213accc3_amd64",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:d7c013a4088c668aacbc00047f00cb1cc0041676f9f8d5a9971ab53fd15d5a69_arm64",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:3345dc986a756c37e0636877a17dfa8483d12338e67d522419e85667f65cfa3e_arm64",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:5f227627f918d7a8b6328843da37547b54271ea93045b9a5d9ede82348b62d01_amd64",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:cb81f87ad3ed182494ec8f8f4d2a0229a28b716ae27f946d221077961534d9cc_ppc64le",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:f9a90f6a24678435a08a9783ac7612629b0702633b9405540b02eb5a6da4c6c9_s390x"
        ],
        "known_not_affected": [
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:20951bbce71da848cf595ae1480a0c46b131b59190fd657774a8932889a8e5da_arm64",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:37069c4ac61fc810096df8c25b1d12f95b04da5f11892fb4c6bcd3a3479d3777_amd64",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:3bdaf268da97b95f85a09a18e42e2cfe61ee56b0131b6f86ac4a41fac4854650_s390x",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:94fa2f56d060b2ac8a384db29bf073683bef50cd60724e893ee1dcb945424517_ppc64le",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:58739fdf7b671103fddd089db340747090d46018435d2f6519fb00436f08684f_s390x",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:841e1897e543548f5494c9495463514d4286697a760326b67c11958933a7ac70_amd64",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:d1a3996d3879700be89bad37bb688f5016078a11dbdda894932115da370508ee_arm64",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:e78a27a6a17ad3f2bd5771ada6ac2357156cd351dc3e976d0495fcdc38a4d891_ppc64le",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:9aca25cbc3ab1ba653d3b427df28f2b5ec1c4c041892e5e7ebd817be0ac56017_amd64",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0fd2089ab716a8733ccdaa909eb7d8663c69de0c87cfc6551ca5a7b93c295a7b_s390x",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:815f222ec62bad59caede1682990af6367fcc4354013b5da96a7b67dd311a4b9_ppc64le",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a12c6e4a54dfe009700be799c8036a09a8845bc84dea533c024ffac0a65dc491_arm64",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:e2c38ca7fa1257940589d6eace9ad5d95c6dbaccf36ae04ce296d0350258e0a0_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-41606"
        },
        {
          "category": "external",
          "summary": "RHBZ#2463408",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463408"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-41606",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-41606"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41606",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41606"
        },
        {
          "category": "external",
          "summary": "http://www.openwall.com/lists/oss-security/2026/04/28/3",
          "url": "http://www.openwall.com/lists/oss-security/2026/04/28/3"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql",
          "url": "https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql"
        }
      ],
      "release_date": "2026-04-28T09:21:12.815000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-07T16:23:20+00:00",
          "details": "For details on how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators",
          "product_ids": [
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:bea6c0fb2bead67356a76060901018b90c2cda12e5ef0ffca8993e16b761ab41_arm64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:cf73a80390a85a34b6b95a097a3e00c0ac5ed1e6e0bd396c1f55233b59de70ef_s390x",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:d21b8336c12507aabdb03ecee43d5e93633b202ea880ae6aced0426b40d972f6_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:f6e5c856ec74d0a7e858448960c4d09d2a24ac7bdce7ff18d1981bd23a45d6cb_amd64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:50bd4b1c745b916a8127a071e9d79dbde85268ab19c49ffb431863f9222152f6_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:5e922a6dc5973688e531cb1bcbb7a9a414f260d64be9c0a66701b7c050f8ed65_s390x",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:745c62848b8ab43bbcddf75a79b53662e0ac0aff050281c879e01c4c213accc3_amd64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:d7c013a4088c668aacbc00047f00cb1cc0041676f9f8d5a9971ab53fd15d5a69_arm64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:3345dc986a756c37e0636877a17dfa8483d12338e67d522419e85667f65cfa3e_arm64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:5f227627f918d7a8b6328843da37547b54271ea93045b9a5d9ede82348b62d01_amd64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:cb81f87ad3ed182494ec8f8f4d2a0229a28b716ae27f946d221077961534d9cc_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:f9a90f6a24678435a08a9783ac7612629b0702633b9405540b02eb5a6da4c6c9_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:14885"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:20951bbce71da848cf595ae1480a0c46b131b59190fd657774a8932889a8e5da_arm64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:37069c4ac61fc810096df8c25b1d12f95b04da5f11892fb4c6bcd3a3479d3777_amd64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:3bdaf268da97b95f85a09a18e42e2cfe61ee56b0131b6f86ac4a41fac4854650_s390x",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:94fa2f56d060b2ac8a384db29bf073683bef50cd60724e893ee1dcb945424517_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:58739fdf7b671103fddd089db340747090d46018435d2f6519fb00436f08684f_s390x",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:841e1897e543548f5494c9495463514d4286697a760326b67c11958933a7ac70_amd64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:d1a3996d3879700be89bad37bb688f5016078a11dbdda894932115da370508ee_arm64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:e78a27a6a17ad3f2bd5771ada6ac2357156cd351dc3e976d0495fcdc38a4d891_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:bea6c0fb2bead67356a76060901018b90c2cda12e5ef0ffca8993e16b761ab41_arm64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:cf73a80390a85a34b6b95a097a3e00c0ac5ed1e6e0bd396c1f55233b59de70ef_s390x",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:d21b8336c12507aabdb03ecee43d5e93633b202ea880ae6aced0426b40d972f6_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:f6e5c856ec74d0a7e858448960c4d09d2a24ac7bdce7ff18d1981bd23a45d6cb_amd64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:9aca25cbc3ab1ba653d3b427df28f2b5ec1c4c041892e5e7ebd817be0ac56017_amd64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:50bd4b1c745b916a8127a071e9d79dbde85268ab19c49ffb431863f9222152f6_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:5e922a6dc5973688e531cb1bcbb7a9a414f260d64be9c0a66701b7c050f8ed65_s390x",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:745c62848b8ab43bbcddf75a79b53662e0ac0aff050281c879e01c4c213accc3_amd64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:d7c013a4088c668aacbc00047f00cb1cc0041676f9f8d5a9971ab53fd15d5a69_arm64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0fd2089ab716a8733ccdaa909eb7d8663c69de0c87cfc6551ca5a7b93c295a7b_s390x",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:815f222ec62bad59caede1682990af6367fcc4354013b5da96a7b67dd311a4b9_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a12c6e4a54dfe009700be799c8036a09a8845bc84dea533c024ffac0a65dc491_arm64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:e2c38ca7fa1257940589d6eace9ad5d95c6dbaccf36ae04ce296d0350258e0a0_amd64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:3345dc986a756c37e0636877a17dfa8483d12338e67d522419e85667f65cfa3e_arm64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:5f227627f918d7a8b6328843da37547b54271ea93045b9a5d9ede82348b62d01_amd64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:cb81f87ad3ed182494ec8f8f4d2a0229a28b716ae27f946d221077961534d9cc_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:f9a90f6a24678435a08a9783ac7612629b0702633b9405540b02eb5a6da4c6c9_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "Apache Thrift: Apache Thrift: Denial of Service via uncontrolled recursion"
    },
    {
      "cve": "CVE-2026-41607",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2026-04-28T10:01:33.022623+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:20951bbce71da848cf595ae1480a0c46b131b59190fd657774a8932889a8e5da_arm64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:37069c4ac61fc810096df8c25b1d12f95b04da5f11892fb4c6bcd3a3479d3777_amd64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:3bdaf268da97b95f85a09a18e42e2cfe61ee56b0131b6f86ac4a41fac4854650_s390x",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:94fa2f56d060b2ac8a384db29bf073683bef50cd60724e893ee1dcb945424517_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:58739fdf7b671103fddd089db340747090d46018435d2f6519fb00436f08684f_s390x",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:841e1897e543548f5494c9495463514d4286697a760326b67c11958933a7ac70_amd64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:d1a3996d3879700be89bad37bb688f5016078a11dbdda894932115da370508ee_arm64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:e78a27a6a17ad3f2bd5771ada6ac2357156cd351dc3e976d0495fcdc38a4d891_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:9aca25cbc3ab1ba653d3b427df28f2b5ec1c4c041892e5e7ebd817be0ac56017_amd64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0fd2089ab716a8733ccdaa909eb7d8663c69de0c87cfc6551ca5a7b93c295a7b_s390x",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:815f222ec62bad59caede1682990af6367fcc4354013b5da96a7b67dd311a4b9_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a12c6e4a54dfe009700be799c8036a09a8845bc84dea533c024ffac0a65dc491_arm64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:e2c38ca7fa1257940589d6eace9ad5d95c6dbaccf36ae04ce296d0350258e0a0_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2463412"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache Thrift. This out-of-bounds read vulnerability can lead to the disclosure of sensitive information or a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Apache Thrift: apache.com/apache/thrift: Apache Thrift: Out-of-bounds Read vulnerability",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:bea6c0fb2bead67356a76060901018b90c2cda12e5ef0ffca8993e16b761ab41_arm64",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:cf73a80390a85a34b6b95a097a3e00c0ac5ed1e6e0bd396c1f55233b59de70ef_s390x",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:d21b8336c12507aabdb03ecee43d5e93633b202ea880ae6aced0426b40d972f6_ppc64le",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:f6e5c856ec74d0a7e858448960c4d09d2a24ac7bdce7ff18d1981bd23a45d6cb_amd64",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:50bd4b1c745b916a8127a071e9d79dbde85268ab19c49ffb431863f9222152f6_ppc64le",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:5e922a6dc5973688e531cb1bcbb7a9a414f260d64be9c0a66701b7c050f8ed65_s390x",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:745c62848b8ab43bbcddf75a79b53662e0ac0aff050281c879e01c4c213accc3_amd64",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:d7c013a4088c668aacbc00047f00cb1cc0041676f9f8d5a9971ab53fd15d5a69_arm64",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:3345dc986a756c37e0636877a17dfa8483d12338e67d522419e85667f65cfa3e_arm64",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:5f227627f918d7a8b6328843da37547b54271ea93045b9a5d9ede82348b62d01_amd64",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:cb81f87ad3ed182494ec8f8f4d2a0229a28b716ae27f946d221077961534d9cc_ppc64le",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:f9a90f6a24678435a08a9783ac7612629b0702633b9405540b02eb5a6da4c6c9_s390x"
        ],
        "known_not_affected": [
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:20951bbce71da848cf595ae1480a0c46b131b59190fd657774a8932889a8e5da_arm64",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:37069c4ac61fc810096df8c25b1d12f95b04da5f11892fb4c6bcd3a3479d3777_amd64",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:3bdaf268da97b95f85a09a18e42e2cfe61ee56b0131b6f86ac4a41fac4854650_s390x",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:94fa2f56d060b2ac8a384db29bf073683bef50cd60724e893ee1dcb945424517_ppc64le",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:58739fdf7b671103fddd089db340747090d46018435d2f6519fb00436f08684f_s390x",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:841e1897e543548f5494c9495463514d4286697a760326b67c11958933a7ac70_amd64",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:d1a3996d3879700be89bad37bb688f5016078a11dbdda894932115da370508ee_arm64",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:e78a27a6a17ad3f2bd5771ada6ac2357156cd351dc3e976d0495fcdc38a4d891_ppc64le",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:9aca25cbc3ab1ba653d3b427df28f2b5ec1c4c041892e5e7ebd817be0ac56017_amd64",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0fd2089ab716a8733ccdaa909eb7d8663c69de0c87cfc6551ca5a7b93c295a7b_s390x",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:815f222ec62bad59caede1682990af6367fcc4354013b5da96a7b67dd311a4b9_ppc64le",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a12c6e4a54dfe009700be799c8036a09a8845bc84dea533c024ffac0a65dc491_arm64",
          "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:e2c38ca7fa1257940589d6eace9ad5d95c6dbaccf36ae04ce296d0350258e0a0_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-41607"
        },
        {
          "category": "external",
          "summary": "RHBZ#2463412",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463412"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-41607",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-41607"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41607",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41607"
        },
        {
          "category": "external",
          "summary": "http://www.openwall.com/lists/oss-security/2026/04/28/2",
          "url": "http://www.openwall.com/lists/oss-security/2026/04/28/2"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql",
          "url": "https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql"
        }
      ],
      "release_date": "2026-04-28T09:21:48.502000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-07T16:23:20+00:00",
          "details": "For details on how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators",
          "product_ids": [
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:bea6c0fb2bead67356a76060901018b90c2cda12e5ef0ffca8993e16b761ab41_arm64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:cf73a80390a85a34b6b95a097a3e00c0ac5ed1e6e0bd396c1f55233b59de70ef_s390x",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:d21b8336c12507aabdb03ecee43d5e93633b202ea880ae6aced0426b40d972f6_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:f6e5c856ec74d0a7e858448960c4d09d2a24ac7bdce7ff18d1981bd23a45d6cb_amd64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:50bd4b1c745b916a8127a071e9d79dbde85268ab19c49ffb431863f9222152f6_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:5e922a6dc5973688e531cb1bcbb7a9a414f260d64be9c0a66701b7c050f8ed65_s390x",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:745c62848b8ab43bbcddf75a79b53662e0ac0aff050281c879e01c4c213accc3_amd64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:d7c013a4088c668aacbc00047f00cb1cc0041676f9f8d5a9971ab53fd15d5a69_arm64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:3345dc986a756c37e0636877a17dfa8483d12338e67d522419e85667f65cfa3e_arm64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:5f227627f918d7a8b6328843da37547b54271ea93045b9a5d9ede82348b62d01_amd64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:cb81f87ad3ed182494ec8f8f4d2a0229a28b716ae27f946d221077961534d9cc_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:f9a90f6a24678435a08a9783ac7612629b0702633b9405540b02eb5a6da4c6c9_s390x"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:14885"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:20951bbce71da848cf595ae1480a0c46b131b59190fd657774a8932889a8e5da_arm64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:37069c4ac61fc810096df8c25b1d12f95b04da5f11892fb4c6bcd3a3479d3777_amd64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:3bdaf268da97b95f85a09a18e42e2cfe61ee56b0131b6f86ac4a41fac4854650_s390x",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:94fa2f56d060b2ac8a384db29bf073683bef50cd60724e893ee1dcb945424517_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:58739fdf7b671103fddd089db340747090d46018435d2f6519fb00436f08684f_s390x",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:841e1897e543548f5494c9495463514d4286697a760326b67c11958933a7ac70_amd64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:d1a3996d3879700be89bad37bb688f5016078a11dbdda894932115da370508ee_arm64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:e78a27a6a17ad3f2bd5771ada6ac2357156cd351dc3e976d0495fcdc38a4d891_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:bea6c0fb2bead67356a76060901018b90c2cda12e5ef0ffca8993e16b761ab41_arm64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:cf73a80390a85a34b6b95a097a3e00c0ac5ed1e6e0bd396c1f55233b59de70ef_s390x",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:d21b8336c12507aabdb03ecee43d5e93633b202ea880ae6aced0426b40d972f6_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:f6e5c856ec74d0a7e858448960c4d09d2a24ac7bdce7ff18d1981bd23a45d6cb_amd64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:9aca25cbc3ab1ba653d3b427df28f2b5ec1c4c041892e5e7ebd817be0ac56017_amd64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:50bd4b1c745b916a8127a071e9d79dbde85268ab19c49ffb431863f9222152f6_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:5e922a6dc5973688e531cb1bcbb7a9a414f260d64be9c0a66701b7c050f8ed65_s390x",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:745c62848b8ab43bbcddf75a79b53662e0ac0aff050281c879e01c4c213accc3_amd64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:d7c013a4088c668aacbc00047f00cb1cc0041676f9f8d5a9971ab53fd15d5a69_arm64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0fd2089ab716a8733ccdaa909eb7d8663c69de0c87cfc6551ca5a7b93c295a7b_s390x",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:815f222ec62bad59caede1682990af6367fcc4354013b5da96a7b67dd311a4b9_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a12c6e4a54dfe009700be799c8036a09a8845bc84dea533c024ffac0a65dc491_arm64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:e2c38ca7fa1257940589d6eace9ad5d95c6dbaccf36ae04ce296d0350258e0a0_amd64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:3345dc986a756c37e0636877a17dfa8483d12338e67d522419e85667f65cfa3e_arm64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:5f227627f918d7a8b6328843da37547b54271ea93045b9a5d9ede82348b62d01_amd64",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:cb81f87ad3ed182494ec8f8f4d2a0229a28b716ae27f946d221077961534d9cc_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:f9a90f6a24678435a08a9783ac7612629b0702633b9405540b02eb5a6da4c6c9_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "Apache Thrift: apache.com/apache/thrift: Apache Thrift: Out-of-bounds Read vulnerability"
    }
  ]
}