Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2026-44432 (GCVE-0-2026-44432)
Vulnerability from cvelistv5 – Published: 2026-05-13 15:17 – Updated: 2026-08-10 12:05
VLAI
EPSS
VEX
Title
urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API
Summary
urllib3 is an HTTP client library for Python. From 2.6.0 to before 2.7.0, urllib3 could decompress the whole response instead of the requested portion (1) during the second HTTPResponse.read(amt=N) call when the response was decompressed using the official Brotli library or (2) when HTTPResponse.drain_conn() was called after the response had been read and decompressed partially (compression algorithm did not matter here). These issues could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This could result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data) on the client side. This vulnerability is fixed in 2.7.0.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification)
Assigner
References
57 references
Impacted products
107 products
| Vendor | Product | Version | |
|---|---|---|---|
| urllib3 | urllib3 |
Affected:
>= 2.6.0, < 2.7.0
|
|
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 8 |
Unaffected:
0:4.6.30-2.el8ap , < *
(rpm)
cpe:/a:redhat:ansible_automation_platform:2.5::el8 |
|
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 9 |
Unaffected:
0:4.6.30-2.el9ap , < *
(rpm)
cpe:/a:redhat:ansible_automation_platform:2.5::el9 |
|
| Red Hat | Red Hat Ansible Automation Platform 2.6 for RHEL 9 |
Unaffected:
0:2.7.0-1.el9ap , < *
(rpm)
cpe:/a:redhat:ansible_automation_platform:2.6::el9 |
|
| Red Hat | Red Hat Ansible Automation Platform 2.6 for RHEL 9 |
Unaffected:
0:4.7.14-3.el9ap , < *
(rpm)
cpe:/a:redhat:ansible_automation_platform:2.6::el9 |
|
| Red Hat | Red Hat Enterprise Linux 10 |
Unaffected:
0:2.6.3-2.el10_2 , < *
(rpm)
cpe:/o:redhat:enterprise_linux:10.2 |
|
| Red Hat | Red Hat Enterprise Linux 10 |
Unaffected:
0:1.26.19-4.el10_2 , < *
(rpm)
cpe:/o:redhat:enterprise_linux:10.2 |
|
| Red Hat | Red Hat Enterprise Linux 8 |
Unaffected:
0:1.26.19-3.el8_10 , < *
(rpm)
cpe:/a:redhat:enterprise_linux:8 |
|
| Red Hat | Red Hat Enterprise Linux 9 |
Unaffected:
0:2.6.3-2.el9_8 , < *
(rpm)
cpe:/a:redhat:enterprise_linux:9 |
|
| Red Hat | Red Hat Enterprise Linux 9 |
Unaffected:
0:1.26.19-3.el9_8 , < *
(rpm)
cpe:/a:redhat:enterprise_linux:9 |
|
| Red Hat | Red Hat Enterprise Linux 9 |
Unaffected:
0:1.26.5-8.el9_8 , < *
(rpm)
cpe:/o:redhat:enterprise_linux:9 |
|
| Red Hat | Red Hat AI Inference Server 3.3 |
Unaffected:
1782352950 , < *
(rpm)
cpe:/a:redhat:ai_inference_server:3.3::el9 |
|
| Red Hat | Red Hat AI Inference Server 3.3 |
Unaffected:
1782352919 , < *
(rpm)
cpe:/a:redhat:ai_inference_server:3.3::el9 |
|
| Red Hat | Red Hat AI Inference Server 3.3 |
Unaffected:
1782353093 , < *
(rpm)
cpe:/a:redhat:ai_inference_server:3.3::el9 |
|
| Red Hat | Red Hat AI Inference Server 3.3 |
Unaffected:
1782352847 , < *
(rpm)
cpe:/a:redhat:ai_inference_server:3.3::el9 |
|
| Red Hat | Red Hat AI Inference Server 3.4 |
Unaffected:
1780356811 , < *
(rpm)
cpe:/a:redhat:ai_inference_server:3.4::el9 |
|
| Red Hat | Red Hat AI Inference Server 3.4 |
Unaffected:
1780356904 , < *
(rpm)
cpe:/a:redhat:ai_inference_server:3.4::el9 |
|
| Red Hat | Red Hat AI Inference Server 3.4 |
Unaffected:
1780356941 , < *
(rpm)
cpe:/a:redhat:ai_inference_server:3.4::el9 |
|
| Red Hat | Red Hat AI Inference Server 3.4 |
Unaffected:
1780356914 , < *
(rpm)
cpe:/a:redhat:ai_inference_server:3.4::el9 |
|
| Red Hat | Red Hat Ansible Automation Platform 2.5 |
Unaffected:
1784050598 , < *
(rpm)
cpe:/a:redhat:ansible_automation_platform:2.5::el8 |
|
| Red Hat | Red Hat Ansible Automation Platform 2.6 |
Unaffected:
1782761510 , < *
(rpm)
cpe:/a:redhat:ansible_automation_platform:2.6::el9 |
|
| Red Hat | Red Hat Ansible Automation Platform 2.6 |
Unaffected:
1782650747 , < *
(rpm)
cpe:/a:redhat:ansible_automation_platform:2.6::el9 |
|
| Red Hat | Red Hat Ansible Automation Platform 2.6 |
Unaffected:
1783973764 , < *
(rpm)
cpe:/a:redhat:ansible_automation_platform:2.6::el9 |
|
| Red Hat | Red Hat Ansible Automation Platform 2.6 |
Unaffected:
1783921549 , < *
(rpm)
cpe:/a:redhat:ansible_automation_platform:2.6::el9 |
|
| Red Hat | Red Hat Ansible Automation Platform 2.6 |
Unaffected:
1783923629 , < *
(rpm)
cpe:/a:redhat:ansible_automation_platform:2.6::el9 |
|
| Red Hat | Red Hat Ansible Automation Platform 2.6 |
Unaffected:
1783969139 , < *
(rpm)
cpe:/a:redhat:ansible_automation_platform:2.6::el9 |
|
| Red Hat | Red Hat Ansible Automation Platform 2.7 |
Unaffected:
1781028735 , < *
(rpm)
cpe:/a:redhat:ansible_automation_platform:2.7::el9 |
|
| Red Hat | Red Hat Ansible Automation Platform 2.7 |
Unaffected:
1781102816 , < *
(rpm)
cpe:/a:redhat:ansible_automation_platform:2.7::el9 |
|
| Red Hat | Red Hat Discovery 2 |
Unaffected:
1779395228 , < *
(rpm)
cpe:/a:redhat:discovery:2::el9 |
|
| Red Hat | Red Hat Discovery 2 |
Unaffected:
1782756541 , < *
(rpm)
cpe:/a:redhat:discovery:2::el9 |
|
| Red Hat | Red Hat Hardened Images |
Unaffected:
0.69.3-1.2.hum1 , < *
(rpm)
cpe:/a:redhat:hummingbird:1 |
|
| Red Hat | Red Hat Hardened Images |
Unaffected:
1.96.0-1.hum1 , < *
(rpm)
cpe:/a:redhat:hummingbird:1 |
|
| Red Hat | Red Hat Hardened Images |
Unaffected:
1.2.1-2.hum1 , < *
(rpm)
cpe:/a:redhat:hummingbird:1 |
|
| Red Hat | Red Hat Hardened Images |
Unaffected:
2.7.0-3.hum1 , < *
(rpm)
cpe:/a:redhat:hummingbird:1 |
|
| Red Hat | Red Hat Hardened Images |
Unaffected:
48.0.0-3.hum1 , < *
(rpm)
cpe:/a:redhat:hummingbird:1 |
|
| Red Hat | Red Hat Hardened Images |
Unaffected:
21.1.8-6.hum1 , < *
(rpm)
cpe:/a:redhat:hummingbird:1 |
|
| Red Hat | Red Hat Hardened Images |
Unaffected:
2026.5.1-1.hum1 , < *
(rpm)
cpe:/a:redhat:hummingbird:1 |
|
| Red Hat | Red Hat Hardened Images |
Unaffected:
2.19.0-1.hum1 , < *
(rpm)
cpe:/a:redhat:hummingbird:1 |
|
| Red Hat | Red Hat Hardened Images |
Unaffected:
11.8.8-1.hum1 , < *
(rpm)
cpe:/a:redhat:hummingbird:1 |
|
| Red Hat | Red Hat Hardened Images |
Unaffected:
2.48.0-4.1.hum1 , < *
(rpm)
cpe:/a:redhat:hummingbird:1 |
|
| Red Hat | Red Hat Hardened Images |
Unaffected:
21.1.8-1.1.hum1 , < *
(rpm)
cpe:/a:redhat:hummingbird:1 |
|
| Red Hat | Red Hat Migration Toolkit for Applications 8.2 |
Unaffected:
1784109883 , < *
(rpm)
cpe:/a:redhat:migration_toolkit_applications:8.2::el9 |
|
| Red Hat | Red Hat OpenShift AI 2.25 |
Unaffected:
1783024305 , < *
(rpm)
cpe:/a:redhat:openshift_ai:2.25::el9 |
|
| Red Hat | Red Hat OpenShift AI 2.25 |
Unaffected:
1783701598 , < *
(rpm)
cpe:/a:redhat:openshift_ai:2.25::el9 |
|
| Red Hat | Red Hat OpenShift AI 2.25 |
Unaffected:
1783342900 , < *
(rpm)
cpe:/a:redhat:openshift_ai:2.25::el9 |
|
| Red Hat | Red Hat OpenShift AI 2.25 |
Unaffected:
1783112979 , < *
(rpm)
cpe:/a:redhat:openshift_ai:2.25::el9 |
|
| Red Hat | Red Hat OpenShift AI 2.25 |
Unaffected:
1783091175 , < *
(rpm)
cpe:/a:redhat:openshift_ai:2.25::el9 |
|
| Red Hat | Red Hat OpenShift AI 2.25 |
Unaffected:
1783998774 , < *
(rpm)
cpe:/a:redhat:openshift_ai:2.25::el9 |
|
| Red Hat | Red Hat OpenShift AI 2.25 |
Unaffected:
1783998857 , < *
(rpm)
cpe:/a:redhat:openshift_ai:2.25::el9 |
|
| Red Hat | Red Hat OpenShift AI 3.3 |
Unaffected:
1783010225 , < *
(rpm)
cpe:/a:redhat:openshift_ai:3.3::el9 |
|
| Red Hat | Red Hat OpenShift AI 3.3 |
Unaffected:
1782917849 , < *
(rpm)
cpe:/a:redhat:openshift_ai:3.3::el9 |
|
| Red Hat | Red Hat OpenShift AI 3.3 |
Unaffected:
1782887848 , < *
(rpm)
cpe:/a:redhat:openshift_ai:3.3::el9 |
|
| Red Hat | Red Hat OpenShift AI 3.3 |
Unaffected:
1782854229 , < *
(rpm)
cpe:/a:redhat:openshift_ai:3.3::el9 |
|
| Red Hat | Red Hat OpenShift AI 3.3 |
Unaffected:
1782471555 , < *
(rpm)
cpe:/a:redhat:openshift_ai:3.3::el9 |
|
| Red Hat | Red Hat OpenShift AI 3.3 |
Unaffected:
1782471579 , < *
(rpm)
cpe:/a:redhat:openshift_ai:3.3::el9 |
|
| Red Hat | Red Hat OpenShift AI 3.3 |
Unaffected:
1783073038 , < *
(rpm)
cpe:/a:redhat:openshift_ai:3.3::el9 |
|
| Red Hat | Red Hat OpenShift AI 3.3 |
Unaffected:
1782991170 , < *
(rpm)
cpe:/a:redhat:openshift_ai:3.3::el9 |
|
| Red Hat | Red Hat OpenShift AI 3.3 |
Unaffected:
1782471656 , < *
(rpm)
cpe:/a:redhat:openshift_ai:3.3::el9 |
|
| Red Hat | Red Hat OpenShift AI 3.3 |
Unaffected:
1782471663 , < *
(rpm)
cpe:/a:redhat:openshift_ai:3.3::el9 |
|
| Red Hat | Red Hat OpenShift AI 3.3 |
Unaffected:
1783069204 , < *
(rpm)
cpe:/a:redhat:openshift_ai:3.3::el9 |
|
| Red Hat | Red Hat OpenShift AI 3.3 |
Unaffected:
1782472374 , < *
(rpm)
cpe:/a:redhat:openshift_ai:3.3::el9 |
|
| Red Hat | Red Hat Quay 3.1 |
Unaffected:
1782487717 , < *
(rpm)
cpe:/a:redhat:quay:3.10::el8 |
|
| Red Hat | Red Hat Quay 3.12 |
Unaffected:
1781937357 , < *
(rpm)
cpe:/a:redhat:quay:3.12::el8 |
|
| Red Hat | Red Hat Quay 3.15 |
Unaffected:
1784351966 , < *
(rpm)
cpe:/a:redhat:quay:3.15::el8 |
|
| Red Hat | Red Hat Quay 3.16 |
Unaffected:
1783955846 , < *
(rpm)
cpe:/a:redhat:quay:3.16::el9 |
|
| Red Hat | Red Hat Quay 3.9 |
Unaffected:
1781878070 , < *
(rpm)
cpe:/a:redhat:quay:3.9::el8 |
|
| Red Hat | Red Hat Satellite 6.18 |
Unaffected:
1779792651 , < *
(rpm)
cpe:/a:redhat:satellite:6.18::el9 |
|
| Red Hat | Red Hat Satellite 6.18 |
Unaffected:
1779711334 , < *
(rpm)
cpe:/a:redhat:satellite:6.18::el9 |
|
| Red Hat | Red Hat Satellite 6.18 |
Unaffected:
1782739344 , < *
(rpm)
cpe:/a:redhat:satellite:6.18::el9 |
|
| Red Hat | Red Hat Satellite 6.19 |
Unaffected:
1782139619 , < *
(rpm)
cpe:/a:redhat:satellite:6.19::el9 |
|
| Red Hat | Red Hat Satellite 6.19 |
Unaffected:
1780393451 , < *
(rpm)
cpe:/a:redhat:satellite:6.19::el9 |
|
| Red Hat | Red Hat Satellite 6.19 |
Unaffected:
1782380482 , < *
(rpm)
cpe:/a:redhat:satellite:6.19::el9 |
|
| Red Hat | Red Hat Satellite 6.19 |
Unaffected:
1782448455 , < *
(rpm)
cpe:/a:redhat:satellite:6.19::el9 |
|
| Red Hat | Red Hat Satellite 6.19 |
Unaffected:
1784558259 , < *
(rpm)
cpe:/a:redhat:satellite:6.19::el9 |
|
| Red Hat | Red Hat Trusted Artifact Signer 1.3 |
Unaffected:
1780560117 , < *
(rpm)
cpe:/a:redhat:trusted_artifact_signer:1.3::el9 |
|
| Red Hat | Red Hat Trusted Artifact Signer 1.4 |
Unaffected:
1780914886 , < *
(rpm)
cpe:/a:redhat:trusted_artifact_signer:1.4::el9 |
|
| Red Hat | Red Hat Update Infrastructure 5 |
Unaffected:
1784794818 , < *
(rpm)
cpe:/a:redhat:rhui:5::el9 |
|
| Red Hat | Red Hat Update Infrastructure 5 |
Unaffected:
1784794778 , < *
(rpm)
cpe:/a:redhat:rhui:5::el9 |
|
| Red Hat | Red Hat Update Infrastructure 5 |
Unaffected:
1784795112 , < *
(rpm)
cpe:/a:redhat:rhui:5::el9 |
|
| Red Hat | Red Hat Update Infrastructure 5 |
Unaffected:
1784794289 , < *
(rpm)
cpe:/a:redhat:rhui:5::el9 |
|
| Red Hat | Red Hat Update Infrastructure 5 |
Unaffected:
1784795076 , < *
(rpm)
cpe:/a:redhat:rhui:5::el9 |
|
| Red Hat | Exploit Intelligence |
cpe:/a:redhat:exploit_intelligence:0 |
|
| Red Hat | External Secrets Operator for Red Hat OpenShift |
cpe:/a:redhat:external_secrets_operator:1 |
|
| Red Hat | Migration Toolkit for Applications 8 |
cpe:/a:redhat:migration_toolkit_applications:8 |
|
| Red Hat | Migration Toolkit for Containers |
cpe:/a:redhat:rhmt:1 |
|
| Red Hat | Migration Toolkit for Virtualization |
cpe:/a:redhat:migration_toolkit_virtualization:2 |
|
| Red Hat | OpenShift Lightspeed |
cpe:/a:redhat:openshift_lightspeed |
|
| Red Hat | OpenShift Service Mesh 3 |
cpe:/a:redhat:service_mesh:3 |
|
| Red Hat | Pen Drive Powered by Red Hat Lightspeed |
cpe:/a:redhat:pdrive_lightspeed:0 cpe:/a:redhat:pdrive_lightspeed:1 |
|
| Red Hat | Red Hat AI Inference Server |
cpe:/a:redhat:ai_inference_server:3 |
|
| Red Hat | Red Hat Ansible Automation Platform 2 |
cpe:/a:redhat:ansible_automation_platform:2 |
|
| Red Hat | Red Hat build of Quarkus Native builder |
cpe:/a:redhat:quarkus:3 |
|
| Red Hat | Red Hat Developer Hub |
cpe:/a:redhat:rhdh:1 |
|
| Red Hat | Red Hat Enterprise Linux 10 |
cpe:/o:redhat:enterprise_linux:10 |
|
| Red Hat | Red Hat Enterprise Linux 6 |
cpe:/o:redhat:enterprise_linux:6 |
|
| Red Hat | Red Hat Enterprise Linux 7 |
cpe:/o:redhat:enterprise_linux:7 |
|
| Red Hat | Red Hat Enterprise Linux 8 |
cpe:/o:redhat:enterprise_linux:8 |
|
| Red Hat | Red Hat Enterprise Linux 9 |
cpe:/o:redhat:enterprise_linux:9 |
|
| Red Hat | Red Hat Enterprise Linux AI (RHEL AI) 3 |
cpe:/a:redhat:enterprise_linux_ai:3 |
|
| Red Hat | Red Hat Hardened Images |
cpe:/a:redhat:hummingbird:1 |
|
| Red Hat | Red Hat OpenShift AI (RHOAI) |
cpe:/a:redhat:openshift_ai |
|
| Red Hat | Red Hat OpenShift Container Platform 4 |
cpe:/a:redhat:openshift:4 |
|
| Red Hat | Red Hat OpenShift Virtualization 4 |
cpe:/a:redhat:container_native_virtualization:4 |
|
| Red Hat | Red Hat OpenStack Platform 17.1 |
cpe:/a:redhat:openstack:17.1 |
|
| Red Hat | Red Hat Satellite 6 |
cpe:/a:redhat:satellite:6 |
|
| Red Hat | Red Hat Update Infrastructure 4 for Cloud Providers |
cpe:/a:redhat:rhui:4::el8 |
|
| Red Hat | Service Telemetry Framework 1.5 |
cpe:/a:redhat:stf:1.5 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-44432",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-15T18:17:39.119999Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-15T18:25:06.331Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.5::el8"
],
"defaultStatus": "affected",
"packageName": "automation-controller",
"product": "Red Hat Ansible Automation Platform 2.5 for RHEL 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.6.30-2.el8ap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.5::el9"
],
"defaultStatus": "affected",
"packageName": "automation-controller",
"product": "Red Hat Ansible Automation Platform 2.5 for RHEL 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.6.30-2.el9ap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.6::el9"
],
"defaultStatus": "affected",
"packageName": "python3.12-urllib3",
"product": "Red Hat Ansible Automation Platform 2.6 for RHEL 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.7.0-1.el9ap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.6::el9"
],
"defaultStatus": "affected",
"packageName": "automation-controller",
"product": "Red Hat Ansible Automation Platform 2.6 for RHEL 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.7.14-3.el9ap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "affected",
"packageName": "python3.14-urllib3",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.6.3-2.el10_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "affected",
"packageName": "python-urllib3",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:1.26.19-4.el10_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "python3.12-urllib3",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:1.26.19-3.el8_10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "python3.14-urllib3",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.6.3-2.el9_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "python3.12-urllib3",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:1.26.19-3.el9_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "python-urllib3",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:1.26.5-8.el9_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3.3::el9"
],
"defaultStatus": "affected",
"packageName": "rhaiis/model-opt-cuda-rhel9",
"product": "Red Hat AI Inference Server 3.3",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782352950",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3.3::el9"
],
"defaultStatus": "affected",
"packageName": "rhaiis/vllm-spyre-rhel9",
"product": "Red Hat AI Inference Server 3.3",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782352919",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3.3::el9"
],
"defaultStatus": "affected",
"packageName": "rhaiis/vllm-rocm-rhel9",
"product": "Red Hat AI Inference Server 3.3",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782353093",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3.3::el9"
],
"defaultStatus": "affected",
"packageName": "rhaiis/vllm-cuda-rhel9",
"product": "Red Hat AI Inference Server 3.3",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782352847",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3.4::el9"
],
"defaultStatus": "affected",
"packageName": "rhaii/vllm-cpu-rhel9",
"product": "Red Hat AI Inference Server 3.4",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1780356811",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3.4::el9"
],
"defaultStatus": "affected",
"packageName": "rhaii/vllm-spyre-rhel9",
"product": "Red Hat AI Inference Server 3.4",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1780356904",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3.4::el9"
],
"defaultStatus": "affected",
"packageName": "rhaii/model-opt-cuda-rhel9",
"product": "Red Hat AI Inference Server 3.4",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1780356941",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3.4::el9"
],
"defaultStatus": "affected",
"packageName": "rhaii/vllm-cuda-rhel9",
"product": "Red Hat AI Inference Server 3.4",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1780356914",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.5::el8"
],
"defaultStatus": "affected",
"packageName": "ansible-automation-platform-25/hub-rhel8",
"product": "Red Hat Ansible Automation Platform 2.5",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1784050598",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.6::el9"
],
"defaultStatus": "affected",
"packageName": "ansible-automation-platform-26/gateway-rhel9",
"product": "Red Hat Ansible Automation Platform 2.6",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782761510",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.6::el9"
],
"defaultStatus": "affected",
"packageName": "ansible-automation-platform-26/lightspeed-chatbot-rhel9",
"product": "Red Hat Ansible Automation Platform 2.6",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782650747",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.6::el9"
],
"defaultStatus": "affected",
"packageName": "ansible-automation-platform-26/controller-rhel9",
"product": "Red Hat Ansible Automation Platform 2.6",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1783973764",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.6::el9"
],
"defaultStatus": "affected",
"packageName": "ansible-automation-platform-26/de-minimal-rhel9",
"product": "Red Hat Ansible Automation Platform 2.6",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1783921549",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.6::el9"
],
"defaultStatus": "affected",
"packageName": "ansible-automation-platform-26/de-supported-rhel9",
"product": "Red Hat Ansible Automation Platform 2.6",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1783923629",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.6::el9"
],
"defaultStatus": "affected",
"packageName": "ansible-automation-platform-tech-preview/metrics-service-rhel9",
"product": "Red Hat Ansible Automation Platform 2.6",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1783969139",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.7::el9"
],
"defaultStatus": "affected",
"packageName": "ansible-automation-platform-27/eda-controller-rhel9",
"product": "Red Hat Ansible Automation Platform 2.7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1781028735",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.7::el9"
],
"defaultStatus": "affected",
"packageName": "ansible-automation-platform-27/hub-rhel9",
"product": "Red Hat Ansible Automation Platform 2.7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1781102816",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:discovery:2::el9"
],
"defaultStatus": "affected",
"packageName": "discovery/discovery-server-rhel9",
"product": "Red Hat Discovery 2",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1779395228",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:discovery:2::el9"
],
"defaultStatus": "affected",
"packageName": "discovery/discovery-ui-rhel9",
"product": "Red Hat Discovery 2",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782756541",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"defaultStatus": "affected",
"packageName": "trivy-main",
"product": "Red Hat Hardened Images",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0.69.3-1.2.hum1",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"defaultStatus": "affected",
"packageName": "rust-main",
"product": "Red Hat Hardened Images",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1.96.0-1.hum1",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"defaultStatus": "affected",
"packageName": "python-trustme-main",
"product": "Red Hat Hardened Images",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1.2.1-2.hum1",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"defaultStatus": "affected",
"packageName": "python-urllib3-main",
"product": "Red Hat Hardened Images",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "2.7.0-3.hum1",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"defaultStatus": "affected",
"packageName": "python-cryptography-main",
"product": "Red Hat Hardened Images",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "48.0.0-3.hum1",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"defaultStatus": "affected",
"packageName": "llvm21-main",
"product": "Red Hat Hardened Images",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "21.1.8-6.hum1",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"defaultStatus": "affected",
"packageName": "python-rpds-py-main",
"product": "Red Hat Hardened Images",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "2026.5.1-1.hum1",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"defaultStatus": "affected",
"packageName": "jaeger-main",
"product": "Red Hat Hardened Images",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "2.19.0-1.hum1",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"defaultStatus": "affected",
"packageName": "mariadb11-8-main",
"product": "Red Hat Hardened Images",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "11.8.8-1.hum1",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"defaultStatus": "affected",
"packageName": "python-sentry-sdk-main",
"product": "Red Hat Hardened Images",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "2.48.0-4.1.hum1",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"defaultStatus": "affected",
"packageName": "llvm-main",
"product": "Red Hat Hardened Images",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "21.1.8-1.1.hum1",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:migration_toolkit_applications:8.2::el9"
],
"defaultStatus": "affected",
"packageName": "mta/mta-solution-server-rhel9",
"product": "Red Hat Migration Toolkit for Applications 8.2",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1784109883",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_ai:2.25::el9"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-kserve-storage-initializer-rhel9",
"product": "Red Hat OpenShift AI 2.25",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1783024305",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_ai:2.25::el9"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-llama-stack-core-rhel9",
"product": "Red Hat OpenShift AI 2.25",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1783701598",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_ai:2.25::el9"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-modelmesh-runtime-adapter-rhel9",
"product": "Red Hat OpenShift AI 2.25",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1783342900",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_ai:2.25::el9"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-model-registry-job-async-upload-rhel9",
"product": "Red Hat OpenShift AI 2.25",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1783112979",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_ai:2.25::el9"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-ta-lmes-job-rhel9",
"product": "Red Hat OpenShift AI 2.25",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1783091175",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_ai:2.25::el9"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-vllm-cuda-rhel9",
"product": "Red Hat OpenShift AI 2.25",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1783998774",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_ai:2.25::el9"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-vllm-rocm-rhel9",
"product": "Red Hat OpenShift AI 2.25",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1783998857",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_ai:3.3::el9"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-kserve-storage-initializer-rhel9",
"product": "Red Hat OpenShift AI 3.3",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1783010225",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_ai:3.3::el9"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-mlflow-rhel9",
"product": "Red Hat OpenShift AI 3.3",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782917849",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_ai:3.3::el9"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-mlserver-rhel9",
"product": "Red Hat OpenShift AI 3.3",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782887848",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_ai:3.3::el9"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-model-registry-job-async-upload-rhel9",
"product": "Red Hat OpenShift AI 3.3",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782854229",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_ai:3.3::el9"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-training-cuda121-torch24-py311-rhel9",
"product": "Red Hat OpenShift AI 3.3",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782471555",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_ai:3.3::el9"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-training-cuda124-torch25-py311-rhel9",
"product": "Red Hat OpenShift AI 3.3",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782471579",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_ai:3.3::el9"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-training-cuda128-torch28-py312-rhel9",
"product": "Red Hat OpenShift AI 3.3",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1783073038",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_ai:3.3::el9"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-training-cuda128-torch29-py312-rhel9",
"product": "Red Hat OpenShift AI 3.3",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782991170",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_ai:3.3::el9"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-training-rocm62-torch24-py311-rhel9",
"product": "Red Hat OpenShift AI 3.3",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782471656",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_ai:3.3::el9"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-training-rocm62-torch25-py311-rhel9",
"product": "Red Hat OpenShift AI 3.3",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782471663",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_ai:3.3::el9"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-training-rocm64-torch28-py312-rhel9",
"product": "Red Hat OpenShift AI 3.3",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1783069204",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_ai:3.3::el9"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-training-rocm64-torch29-py312-rhel9",
"product": "Red Hat OpenShift AI 3.3",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782991170",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_ai:3.3::el9"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-trustyai-garak-lls-provider-dsp-rhel9",
"product": "Red Hat OpenShift AI 3.3",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782472374",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:quay:3.10::el8"
],
"defaultStatus": "affected",
"packageName": "quay/quay-rhel8",
"product": "Red Hat Quay 3.1",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782487717",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:quay:3.12::el8"
],
"defaultStatus": "affected",
"packageName": "quay/quay-rhel8",
"product": "Red Hat Quay 3.12",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1781937357",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:quay:3.15::el8"
],
"defaultStatus": "affected",
"packageName": "quay/quay-rhel8",
"product": "Red Hat Quay 3.15",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1784351966",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:quay:3.16::el9"
],
"defaultStatus": "affected",
"packageName": "quay/quay-rhel9",
"product": "Red Hat Quay 3.16",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1783955846",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:quay:3.9::el8"
],
"defaultStatus": "affected",
"packageName": "quay/quay-rhel8",
"product": "Red Hat Quay 3.9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1781878070",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:satellite:6.18::el9"
],
"defaultStatus": "affected",
"packageName": "satellite/iop-puptoo-rhel9",
"product": "Red Hat Satellite 6.18",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1779792651",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:satellite:6.18::el9"
],
"defaultStatus": "affected",
"packageName": "satellite/iop-insights-engine-rhel9",
"product": "Red Hat Satellite 6.18",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1779711334",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:satellite:6.18::el9"
],
"defaultStatus": "affected",
"packageName": "satellite/foreman-mcp-server-rhel9",
"product": "Red Hat Satellite 6.18",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782739344",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:satellite:6.19::el9"
],
"defaultStatus": "affected",
"packageName": "satellite/iop-vmaas-rhel9",
"product": "Red Hat Satellite 6.19",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782139619",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:satellite:6.19::el9"
],
"defaultStatus": "affected",
"packageName": "satellite/iop-puptoo-rhel9",
"product": "Red Hat Satellite 6.19",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1780393451",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:satellite:6.19::el9"
],
"defaultStatus": "affected",
"packageName": "satellite/iop-yuptoo-rhel9",
"product": "Red Hat Satellite 6.19",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782380482",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:satellite:6.19::el9"
],
"defaultStatus": "affected",
"packageName": "satellite/iop-insights-engine-rhel9",
"product": "Red Hat Satellite 6.19",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782448455",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:satellite:6.19::el9"
],
"defaultStatus": "affected",
"packageName": "satellite/iop-advisor-backend-rhel9",
"product": "Red Hat Satellite 6.19",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1784558259",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:trusted_artifact_signer:1.3::el9"
],
"defaultStatus": "affected",
"packageName": "rhtas/segment-reporting-rhel9",
"product": "Red Hat Trusted Artifact Signer 1.3",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1780560117",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:trusted_artifact_signer:1.4::el9"
],
"defaultStatus": "affected",
"packageName": "rhtas/model-transparency-rhel9",
"product": "Red Hat Trusted Artifact Signer 1.4",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1780914886",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:rhui:5::el9"
],
"defaultStatus": "affected",
"packageName": "rhui5/cds-kubernetes-rhel9",
"product": "Red Hat Update Infrastructure 5",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1784794818",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:rhui:5::el9"
],
"defaultStatus": "affected",
"packageName": "rhui5/cds-rhel9",
"product": "Red Hat Update Infrastructure 5",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1784794778",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:rhui:5::el9"
],
"defaultStatus": "affected",
"packageName": "rhui5/haproxy-rhel9",
"product": "Red Hat Update Infrastructure 5",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1784795112",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:rhui:5::el9"
],
"defaultStatus": "affected",
"packageName": "rhui5/installer-rhel9",
"product": "Red Hat Update Infrastructure 5",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1784794289",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:rhui:5::el9"
],
"defaultStatus": "affected",
"packageName": "rhui5/rhua-rhel9",
"product": "Red Hat Update Infrastructure 5",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1784795076",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:exploit_intelligence:0"
],
"defaultStatus": "unaffected",
"packageName": "exploit-intelligence-tech-preview/vulnerability-analysis-rhel9",
"product": "Exploit Intelligence",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:external_secrets_operator:1"
],
"defaultStatus": "unaffected",
"packageName": "external-secrets-operator/bitwarden-sdk-server-rhel9",
"product": "External Secrets Operator for Red Hat OpenShift",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:external_secrets_operator:1"
],
"defaultStatus": "unaffected",
"packageName": "external-secrets-operator/external-secrets-operator-bundle",
"product": "External Secrets Operator for Red Hat OpenShift",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:external_secrets_operator:1"
],
"defaultStatus": "unaffected",
"packageName": "external-secrets-operator/external-secrets-operator-rhel9",
"product": "External Secrets Operator for Red Hat OpenShift",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:external_secrets_operator:1"
],
"defaultStatus": "unaffected",
"packageName": "external-secrets-operator/external-secrets-rhel9",
"product": "External Secrets Operator for Red Hat OpenShift",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:migration_toolkit_applications:8"
],
"defaultStatus": "affected",
"packageName": "mta/mta-rhel9-operator",
"product": "Migration Toolkit for Applications 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhmt:1"
],
"defaultStatus": "unaffected",
"packageName": "rhmtc/openshift-migration-rhel8-operator",
"product": "Migration Toolkit for Containers",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:migration_toolkit_virtualization:2"
],
"defaultStatus": "unaffected",
"packageName": "migration-toolkit-virtualization/mtv-rhel9-operator",
"product": "Migration Toolkit for Virtualization",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:migration_toolkit_virtualization:2"
],
"defaultStatus": "unaffected",
"packageName": "mtv-candidate/mtv-rhel9-operator",
"product": "Migration Toolkit for Virtualization",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_lightspeed"
],
"defaultStatus": "unaffected",
"packageName": "openshift-lightspeed/lightspeed-ocp-rag-rhel9",
"product": "OpenShift Lightspeed",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_lightspeed"
],
"defaultStatus": "affected",
"packageName": "openshift-lightspeed/lightspeed-service-api-rhel9",
"product": "OpenShift Lightspeed",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_lightspeed"
],
"defaultStatus": "affected",
"packageName": "openshift-lightspeed/lightspeed-to-dataverse-exporter-rhel9",
"product": "OpenShift Lightspeed",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:service_mesh:3"
],
"defaultStatus": "unaffected",
"packageName": "openshift-service-mesh/kiali-rhel9-operator",
"product": "OpenShift Service Mesh 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:pdrive_lightspeed:0",
"cpe:/a:redhat:pdrive_lightspeed:1"
],
"defaultStatus": "affected",
"packageName": "pen-drive/pen-drive-scanner-rhel9",
"product": "Pen Drive Powered by Red Hat Lightspeed",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
],
"defaultStatus": "affected",
"packageName": "rhaiis/vllm-neuron-rhel9",
"product": "Red Hat AI Inference Server",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ai_inference_server:3"
],
"defaultStatus": "affected",
"packageName": "rhaiis/vllm-tpu-rhel9",
"product": "Red Hat AI Inference Server",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
],
"defaultStatus": "affected",
"packageName": "ansible-automation-platform-24/lightspeed-rhel8",
"product": "Red Hat Ansible Automation Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
],
"defaultStatus": "unaffected",
"packageName": "ansible-automation-platform-25/ee-supported-rhel8",
"product": "Red Hat Ansible Automation Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
],
"defaultStatus": "affected",
"packageName": "ansible-automation-platform-25/lightspeed-chatbot-rhel8",
"product": "Red Hat Ansible Automation Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
],
"defaultStatus": "affected",
"packageName": "ansible-automation-platform-25/lightspeed-rhel8",
"product": "Red Hat Ansible Automation Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
],
"defaultStatus": "affected",
"packageName": "ansible-automation-platform-26/eda-controller-rhel9-operator",
"product": "Red Hat Ansible Automation Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
],
"defaultStatus": "unaffected",
"packageName": "ansible-automation-platform-26/ee-minimal-rhel9",
"product": "Red Hat Ansible Automation Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
],
"defaultStatus": "unaffected",
"packageName": "ansible-automation-platform-26/ee-supported-rhel9",
"product": "Red Hat Ansible Automation Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
],
"defaultStatus": "affected",
"packageName": "ansible-automation-platform-26/gateway-rhel9-operator",
"product": "Red Hat Ansible Automation Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
],
"defaultStatus": "affected",
"packageName": "ansible-automation-platform-26/hub-rhel9-operator",
"product": "Red Hat Ansible Automation Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
],
"defaultStatus": "affected",
"packageName": "ansible-automation-platform-26/lightspeed-rhel9",
"product": "Red Hat Ansible Automation Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
],
"defaultStatus": "affected",
"packageName": "ansible-automation-platform-26/lightspeed-rhel9-operator",
"product": "Red Hat Ansible Automation Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
],
"defaultStatus": "affected",
"packageName": "ansible-automation-platform-26/platform-resource-rhel9-operator",
"product": "Red Hat Ansible Automation Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
],
"defaultStatus": "affected",
"packageName": "ansible-automation-platform-26/platform-resource-runner-rhel9",
"product": "Red Hat Ansible Automation Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
],
"defaultStatus": "affected",
"packageName": "ansible-automation-platform/automation-dashboard-rhel9",
"product": "Red Hat Ansible Automation Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
],
"defaultStatus": "affected",
"packageName": "ansible-automation-platform-tech-preview/metrics-service-rhel9-operator",
"product": "Red Hat Ansible Automation Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
],
"defaultStatus": "unaffected",
"packageName": "python-urllib3",
"product": "Red Hat Ansible Automation Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:quarkus:3"
],
"defaultStatus": "unaffected",
"packageName": "urllib3",
"product": "Red Hat build of Quarkus Native builder",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhdh:1"
],
"defaultStatus": "unaffected",
"packageName": "rhdh/rhdh-hub-rhel9",
"product": "Red Hat Developer Hub",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "unaffected",
"packageName": "python3.14-pip",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "unaffected",
"packageName": "python-pip",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unaffected",
"packageName": "python-urllib3",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "python-pip",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "python-s3transfer",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "python-urllib3",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "fence-agents",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "python3.11-pip",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "python3.12-pip",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "python-pip",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "python-urllib3",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "resource-agents",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unaffected",
"packageName": "fence-agents",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unaffected",
"packageName": "python3.11-pip",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unaffected",
"packageName": "python3.12-pip",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unaffected",
"packageName": "python3.14-pip",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unaffected",
"packageName": "python-pip",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3"
],
"defaultStatus": "unaffected",
"packageName": "rhelai3/bootc-aws-cuda-rhel9",
"product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3"
],
"defaultStatus": "unaffected",
"packageName": "rhelai3/bootc-azure-cuda-rhel9",
"product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3"
],
"defaultStatus": "unaffected",
"packageName": "rhelai3/bootc-azure-rocm-rhel9",
"product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3"
],
"defaultStatus": "unaffected",
"packageName": "rhelai3/bootc-cuda-rhel9",
"product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3"
],
"defaultStatus": "unaffected",
"packageName": "rhelai3/bootc-gcp-cuda-rhel9",
"product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3"
],
"defaultStatus": "unaffected",
"packageName": "rhelai3/bootc-rocm-rhel9",
"product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3"
],
"defaultStatus": "unaffected",
"packageName": "rhelai3/disk-image-cuda-rhel9",
"product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"defaultStatus": "unaffected",
"packageName": "python-attrs",
"product": "Red Hat Hardened Images",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-built-in-detector-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-caikit-nlp-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-caikit-tgis-serving-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-feature-server-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-guardrails-detector-huggingface-runtime-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-kserve-agent-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-kserve-controller-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-kserve-router-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-llm-d-inference-scheduler-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-ml-pipelines-runtime-generic-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-modelmesh-runtime-adapter-rhel8",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-openvino-model-server-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-trustyai-nemo-guardrails-server-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-vllm-gaudi-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-workbench-jupyter-minimal-rocm-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/rhai-cli-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "unaffected",
"packageName": "openshift4/ose-agent-installer-api-server-rhel9",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "affected",
"packageName": "openshift4/ose-ansible-rhel9-operator",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "unaffected",
"packageName": "openshift4/ose-olm-catalogd-rhel9",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "unaffected",
"packageName": "openshift4/ztp-site-generate-rhel8",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "unaffected",
"packageName": "rhcos",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:container_native_virtualization:4"
],
"defaultStatus": "unaffected",
"packageName": "container-native-virtualization/hyperconverged-cluster-operator-rhel9",
"product": "Red Hat OpenShift Virtualization 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:container_native_virtualization:4"
],
"defaultStatus": "unaffected",
"packageName": "container-native-virtualization/hyperconverged-cluster-webhook-rhel9",
"product": "Red Hat OpenShift Virtualization 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openstack:17.1"
],
"defaultStatus": "unaffected",
"packageName": "python-urllib3",
"product": "Red Hat OpenStack Platform 17.1",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:satellite:6"
],
"defaultStatus": "unaffected",
"packageName": "python-urllib3",
"product": "Red Hat Satellite 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:satellite:6"
],
"defaultStatus": "unaffected",
"packageName": "satellite-capsule:el8/python-urllib3",
"product": "Red Hat Satellite 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:satellite:6"
],
"defaultStatus": "unaffected",
"packageName": "satellite/iop-advisor-engine-rhel9",
"product": "Red Hat Satellite 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:satellite:6"
],
"defaultStatus": "unaffected",
"packageName": "satellite/iop-host-inventory-rhel9",
"product": "Red Hat Satellite 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:satellite:6"
],
"defaultStatus": "unaffected",
"packageName": "satellite/iop-vulnerability-engine-rhel9",
"product": "Red Hat Satellite 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhui:4::el8"
],
"defaultStatus": "unaffected",
"packageName": "python-urllib3",
"product": "Red Hat Update Infrastructure 4 for Cloud Providers",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:stf:1.5"
],
"defaultStatus": "affected",
"packageName": "stf/service-telemetry-rhel9-operator",
"product": "Service Telemetry Framework 1.5",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:stf:1.5"
],
"defaultStatus": "affected",
"packageName": "stf/smart-gateway-rhel9-operator",
"product": "Service Telemetry Framework 1.5",
"vendor": "Red Hat"
}
],
"datePublic": "2026-05-13T15:17:12.611Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in urllib3, an HTTP client library for Python. This vulnerability allows a remote attacker to cause excessive resource consumption, such as high CPU usage and massive memory allocation, on the client side. This occurs when urllib3 attempts to decompress an entire HTTP response, even if only a partial read was requested, or when draining the connection after a partial decompression. This can lead to a Denial of Service (DoS) condition."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-409",
"description": "Improper Handling of Highly Compressed Data (Data Amplification)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T12:05:44.180Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-44432"
},
{
"name": "RHBZ#2477154",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477154"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44432.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:42078"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:34160"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:42079"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:27929"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:32992"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:28159"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:28157"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:28000"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:28158"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:30078"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:30089"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:30088"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:30087"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:24542"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:24540"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:24544"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:24541"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:42144"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:42132"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:34374"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:25928"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:20338"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33313"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:25039"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:7634"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:24069"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:25143"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:24014"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:24374"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:7625"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:24000"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:24009"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:22934"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:15862"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:43038"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:42644"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:37275"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:30076"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:42796"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:41066"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:33683"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:28571"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36350"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:26304"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:26212"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:51206"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:34607"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:34531"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:34526"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:34533"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:24476"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:24483"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:44481"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:42078: Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9"
},
{
"lang": "en",
"value": "RHSA-2026:34160: Red Hat Ansible Automation Platform 2.6 for RHEL 9"
},
{
"lang": "en",
"value": "RHSA-2026:42079: Red Hat Ansible Automation Platform 2.6 for RHEL 9"
},
{
"lang": "en",
"value": "RHSA-2026:27929: Red Hat Enterprise Linux AppStream (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:32992: Red Hat Enterprise Linux AppStream (v. 8)"
},
{
"lang": "en",
"value": "RHSA-2026:28159: Red Hat Enterprise Linux AppStream (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:28157: Red Hat Enterprise Linux AppStream (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:28000: Red Hat Enterprise Linux BaseOS (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:28158: Red Hat Enterprise Linux BaseOS (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:30078: Red Hat AI Inference Server 3.3"
},
{
"lang": "en",
"value": "RHSA-2026:30089: Red Hat AI Inference Server 3.3"
},
{
"lang": "en",
"value": "RHSA-2026:30088: Red Hat AI Inference Server 3.3"
},
{
"lang": "en",
"value": "RHSA-2026:30087: Red Hat AI Inference Server 3.3"
},
{
"lang": "en",
"value": "RHSA-2026:24542: Red Hat AI Inference Server 3.4"
},
{
"lang": "en",
"value": "RHSA-2026:24540: Red Hat AI Inference Server 3.4"
},
{
"lang": "en",
"value": "RHSA-2026:24544: Red Hat AI Inference Server 3.4"
},
{
"lang": "en",
"value": "RHSA-2026:24541: Red Hat AI Inference Server 3.4"
},
{
"lang": "en",
"value": "RHSA-2026:42144: Red Hat Ansible Automation Platform 2.5"
},
{
"lang": "en",
"value": "RHSA-2026:42132: Red Hat Ansible Automation Platform 2.6"
},
{
"lang": "en",
"value": "RHSA-2026:34374: Red Hat Ansible Automation Platform 2.6"
},
{
"lang": "en",
"value": "RHSA-2026:25928: Red Hat Ansible Automation Platform 2.7"
},
{
"lang": "en",
"value": "RHSA-2026:20338: Red Hat Discovery 2"
},
{
"lang": "en",
"value": "RHSA-2026:33313: Red Hat Discovery 2"
},
{
"lang": "en",
"value": "RHSA-2026:25039: Red Hat Hardened Images"
},
{
"lang": "en",
"value": "RHSA-2026:7634: Red Hat Hardened Images"
},
{
"lang": "en",
"value": "RHSA-2026:24069: Red Hat Hardened Images"
},
{
"lang": "en",
"value": "RHSA-2026:25143: Red Hat Hardened Images"
},
{
"lang": "en",
"value": "RHSA-2026:24014: Red Hat Hardened Images"
},
{
"lang": "en",
"value": "RHSA-2026:24374: Red Hat Hardened Images"
},
{
"lang": "en",
"value": "RHSA-2026:7625: Red Hat Hardened Images"
},
{
"lang": "en",
"value": "RHSA-2026:24000: Red Hat Hardened Images"
},
{
"lang": "en",
"value": "RHSA-2026:24009: Red Hat Hardened Images"
},
{
"lang": "en",
"value": "RHSA-2026:22934: Red Hat Hardened Images"
},
{
"lang": "en",
"value": "RHSA-2026:15862: Red Hat Hardened Images"
},
{
"lang": "en",
"value": "RHSA-2026:43038: Red Hat Migration Toolkit for Applications 8.2"
},
{
"lang": "en",
"value": "RHSA-2026:42644: Red Hat OpenShift AI 2.25"
},
{
"lang": "en",
"value": "RHSA-2026:37275: Red Hat OpenShift AI 3.3"
},
{
"lang": "en",
"value": "RHSA-2026:30076: Red Hat Quay 3.12"
},
{
"lang": "en",
"value": "RHSA-2026:42796: Red Hat Quay 3.15"
},
{
"lang": "en",
"value": "RHSA-2026:41066: Red Hat Quay 3.16"
},
{
"lang": "en",
"value": "RHSA-2026:33683: Red Hat Quay 3.1"
},
{
"lang": "en",
"value": "RHSA-2026:28571: Red Hat Quay 3.9"
},
{
"lang": "en",
"value": "RHSA-2026:36350: Red Hat Satellite 6.18"
},
{
"lang": "en",
"value": "RHSA-2026:26304: Red Hat Satellite 6.18"
},
{
"lang": "en",
"value": "RHSA-2026:26212: Red Hat Satellite 6.18"
},
{
"lang": "en",
"value": "RHSA-2026:51206: Red Hat Satellite 6.19"
},
{
"lang": "en",
"value": "RHSA-2026:34607: Red Hat Satellite 6.19"
},
{
"lang": "en",
"value": "RHSA-2026:34531: Red Hat Satellite 6.19"
},
{
"lang": "en",
"value": "RHSA-2026:34526: Red Hat Satellite 6.19"
},
{
"lang": "en",
"value": "RHSA-2026:34533: Red Hat Satellite 6.19"
},
{
"lang": "en",
"value": "RHSA-2026:24476: Red Hat Trusted Artifact Signer 1.3"
},
{
"lang": "en",
"value": "RHSA-2026:24483: Red Hat Trusted Artifact Signer 1.4"
},
{
"lang": "en",
"value": "RHSA-2026:44481: Red Hat Update Infrastructure 5"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-13T17:01:01.083Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-05-13T15:17:12.611Z",
"value": "Made public."
}
],
"title": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression",
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"product": "urllib3",
"vendor": "urllib3",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.6.0, \u003c 2.7.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "urllib3 is an HTTP client library for Python. From 2.6.0 to before 2.7.0, urllib3 could decompress the whole response instead of the requested portion (1) during the second HTTPResponse.read(amt=N) call when the response was decompressed using the official Brotli library or (2) when HTTPResponse.drain_conn() was called after the response had been read and decompressed partially (compression algorithm did not matter here). These issues could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This could result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data) on the client side. This vulnerability is fixed in 2.7.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.9,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-409",
"description": "CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-13T15:17:12.611Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j"
}
],
"source": {
"advisory": "GHSA-mf9v-mfxr-j63j",
"discovery": "UNKNOWN"
},
"title": "urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-44432",
"datePublished": "2026-05-13T15:17:12.611Z",
"dateReserved": "2026-05-06T14:40:00.954Z",
"dateUpdated": "2026-08-10T12:05:44.180Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-44432",
"date": "2026-08-11",
"epss": "0.0068",
"percentile": "0.49058"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2026-44432\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-05-13T16:16:57.303\",\"lastModified\":\"2026-08-07T12:17:56.043\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"urllib3 is an HTTP client library for Python. From 2.6.0 to before 2.7.0, urllib3 could decompress the whole response instead of the requested portion (1) during the second HTTPResponse.read(amt=N) call when the response was decompressed using the official Brotli library or (2) when HTTPResponse.drain_conn() was called after the response had been read and decompressed partially (compression algorithm did not matter here). These issues could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This could result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data) on the client side. This vulnerability is fixed in 2.7.0.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"urllib3\",\"product\":\"urllib3\",\"versions\":[{\"version\":\"\u003e= 2.6.0, \u003c 2.7.0\",\"status\":\"affected\"}]}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"affectedData\":[{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2.5 for RHEL 8\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"automation-controller\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2.5::el8\"],\"versions\":[{\"version\":\"0:4.6.30-2.el8ap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2.5 for RHEL 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"automation-controller\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2.5::el9\"],\"versions\":[{\"version\":\"0:4.6.30-2.el9ap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2.6 for RHEL 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"python3.12-urllib3\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2.6::el9\"],\"versions\":[{\"version\":\"0:2.7.0-1.el9ap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2.6 for RHEL 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"automation-controller\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2.6::el9\"],\"versions\":[{\"version\":\"0:4.7.14-3.el9ap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"python3.14-urllib3\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10.2\"],\"versions\":[{\"version\":\"0:2.6.3-2.el10_2\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"python-urllib3\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10.2\"],\"versions\":[{\"version\":\"0:1.26.19-4.el10_2\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"python3.12-urllib3\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux:8\"],\"versions\":[{\"version\":\"0:1.26.19-3.el8_10\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"python3.14-urllib3\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux:9\"],\"versions\":[{\"version\":\"0:2.6.3-2.el9_8\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"python3.12-urllib3\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux:9\"],\"versions\":[{\"version\":\"0:1.26.19-3.el9_8\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"python-urllib3\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:9\"],\"versions\":[{\"version\":\"0:1.26.5-8.el9_8\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat AI Inference Server 3.3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhaiis/model-opt-cuda-rhel9\",\"cpes\":[\"cpe:/a:redhat:ai_inference_server:3.3::el9\"],\"versions\":[{\"version\":\"1782352950\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat AI Inference Server 3.3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhaiis/vllm-spyre-rhel9\",\"cpes\":[\"cpe:/a:redhat:ai_inference_server:3.3::el9\"],\"versions\":[{\"version\":\"1782352919\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat AI Inference Server 3.3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhaiis/vllm-rocm-rhel9\",\"cpes\":[\"cpe:/a:redhat:ai_inference_server:3.3::el9\"],\"versions\":[{\"version\":\"1782353093\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat AI Inference Server 3.3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhaiis/vllm-cuda-rhel9\",\"cpes\":[\"cpe:/a:redhat:ai_inference_server:3.3::el9\"],\"versions\":[{\"version\":\"1782352847\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat AI Inference Server 3.4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhaii/vllm-cpu-rhel9\",\"cpes\":[\"cpe:/a:redhat:ai_inference_server:3.4::el9\"],\"versions\":[{\"version\":\"1780356811\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat AI Inference Server 3.4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhaii/vllm-spyre-rhel9\",\"cpes\":[\"cpe:/a:redhat:ai_inference_server:3.4::el9\"],\"versions\":[{\"version\":\"1780356904\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat AI Inference Server 3.4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhaii/model-opt-cuda-rhel9\",\"cpes\":[\"cpe:/a:redhat:ai_inference_server:3.4::el9\"],\"versions\":[{\"version\":\"1780356941\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat AI Inference Server 3.4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhaii/vllm-cuda-rhel9\",\"cpes\":[\"cpe:/a:redhat:ai_inference_server:3.4::el9\"],\"versions\":[{\"version\":\"1780356914\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2.5\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ansible-automation-platform-25/hub-rhel8\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2.5::el8\"],\"versions\":[{\"version\":\"1784050598\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2.6\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ansible-automation-platform-26/gateway-rhel9\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2.6::el9\"],\"versions\":[{\"version\":\"1782761510\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2.6\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ansible-automation-platform-26/lightspeed-chatbot-rhel9\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2.6::el9\"],\"versions\":[{\"version\":\"1782650747\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2.6\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ansible-automation-platform-26/controller-rhel9\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2.6::el9\"],\"versions\":[{\"version\":\"1783973764\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2.6\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ansible-automation-platform-26/de-minimal-rhel9\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2.6::el9\"],\"versions\":[{\"version\":\"1783921549\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2.6\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ansible-automation-platform-26/de-supported-rhel9\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2.6::el9\"],\"versions\":[{\"version\":\"1783923629\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2.6\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ansible-automation-platform-tech-preview/metrics-service-rhel9\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2.6::el9\"],\"versions\":[{\"version\":\"1783969139\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2.7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ansible-automation-platform-27/eda-controller-rhel9\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2.7::el9\"],\"versions\":[{\"version\":\"1781028735\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2.7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ansible-automation-platform-27/hub-rhel9\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2.7::el9\"],\"versions\":[{\"version\":\"1781102816\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Discovery 2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"discovery/discovery-server-rhel9\",\"cpes\":[\"cpe:/a:redhat:discovery:2::el9\"],\"versions\":[{\"version\":\"1779395228\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Discovery 2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"discovery/discovery-ui-rhel9\",\"cpes\":[\"cpe:/a:redhat:discovery:2::el9\"],\"versions\":[{\"version\":\"1782756541\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Hardened Images\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"trivy-main\",\"cpes\":[\"cpe:/a:redhat:hummingbird:1\"],\"versions\":[{\"version\":\"0.69.3-1.2.hum1\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Hardened Images\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rust-main\",\"cpes\":[\"cpe:/a:redhat:hummingbird:1\"],\"versions\":[{\"version\":\"1.96.0-1.hum1\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Hardened Images\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"python-trustme-main\",\"cpes\":[\"cpe:/a:redhat:hummingbird:1\"],\"versions\":[{\"version\":\"1.2.1-2.hum1\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Hardened Images\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"python-urllib3-main\",\"cpes\":[\"cpe:/a:redhat:hummingbird:1\"],\"versions\":[{\"version\":\"2.7.0-3.hum1\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Hardened Images\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"python-cryptography-main\",\"cpes\":[\"cpe:/a:redhat:hummingbird:1\"],\"versions\":[{\"version\":\"48.0.0-3.hum1\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Hardened Images\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"llvm21-main\",\"cpes\":[\"cpe:/a:redhat:hummingbird:1\"],\"versions\":[{\"version\":\"21.1.8-6.hum1\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Hardened Images\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"python-rpds-py-main\",\"cpes\":[\"cpe:/a:redhat:hummingbird:1\"],\"versions\":[{\"version\":\"2026.5.1-1.hum1\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Hardened Images\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"jaeger-main\",\"cpes\":[\"cpe:/a:redhat:hummingbird:1\"],\"versions\":[{\"version\":\"2.19.0-1.hum1\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Hardened Images\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"mariadb11-8-main\",\"cpes\":[\"cpe:/a:redhat:hummingbird:1\"],\"versions\":[{\"version\":\"11.8.8-1.hum1\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Hardened Images\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"python-sentry-sdk-main\",\"cpes\":[\"cpe:/a:redhat:hummingbird:1\"],\"versions\":[{\"version\":\"2.48.0-4.1.hum1\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Hardened Images\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"llvm-main\",\"cpes\":[\"cpe:/a:redhat:hummingbird:1\"],\"versions\":[{\"version\":\"21.1.8-1.1.hum1\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Migration Toolkit for Applications 8.2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"mta/mta-solution-server-rhel9\",\"cpes\":[\"cpe:/a:redhat:migration_toolkit_applications:8.2::el9\"],\"versions\":[{\"version\":\"1784109883\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI 2.25\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhoai/odh-kserve-storage-initializer-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai:2.25::el9\"],\"versions\":[{\"version\":\"1783024305\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI 2.25\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhoai/odh-llama-stack-core-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai:2.25::el9\"],\"versions\":[{\"version\":\"1783701598\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI 2.25\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhoai/odh-modelmesh-runtime-adapter-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai:2.25::el9\"],\"versions\":[{\"version\":\"1783342900\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI 2.25\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhoai/odh-model-registry-job-async-upload-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai:2.25::el9\"],\"versions\":[{\"version\":\"1783112979\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI 2.25\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhoai/odh-ta-lmes-job-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai:2.25::el9\"],\"versions\":[{\"version\":\"1783091175\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI 2.25\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhoai/odh-vllm-cuda-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai:2.25::el9\"],\"versions\":[{\"version\":\"1783998774\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI 2.25\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhoai/odh-vllm-rocm-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai:2.25::el9\"],\"versions\":[{\"version\":\"1783998857\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI 3.3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhoai/odh-kserve-storage-initializer-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai:3.3::el9\"],\"versions\":[{\"version\":\"1783010225\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI 3.3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhoai/odh-mlflow-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai:3.3::el9\"],\"versions\":[{\"version\":\"1782917849\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI 3.3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhoai/odh-mlserver-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai:3.3::el9\"],\"versions\":[{\"version\":\"1782887848\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI 3.3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhoai/odh-model-registry-job-async-upload-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai:3.3::el9\"],\"versions\":[{\"version\":\"1782854229\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI 3.3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhoai/odh-training-cuda121-torch24-py311-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai:3.3::el9\"],\"versions\":[{\"version\":\"1782471555\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI 3.3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhoai/odh-training-cuda124-torch25-py311-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai:3.3::el9\"],\"versions\":[{\"version\":\"1782471579\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI 3.3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhoai/odh-training-cuda128-torch28-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai:3.3::el9\"],\"versions\":[{\"version\":\"1783073038\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI 3.3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhoai/odh-training-cuda128-torch29-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai:3.3::el9\"],\"versions\":[{\"version\":\"1782991170\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI 3.3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhoai/odh-training-rocm62-torch24-py311-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai:3.3::el9\"],\"versions\":[{\"version\":\"1782471656\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI 3.3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhoai/odh-training-rocm62-torch25-py311-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai:3.3::el9\"],\"versions\":[{\"version\":\"1782471663\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI 3.3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhoai/odh-training-rocm64-torch28-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai:3.3::el9\"],\"versions\":[{\"version\":\"1783069204\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI 3.3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhoai/odh-training-rocm64-torch29-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai:3.3::el9\"],\"versions\":[{\"version\":\"1782991170\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI 3.3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhoai/odh-trustyai-garak-lls-provider-dsp-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai:3.3::el9\"],\"versions\":[{\"version\":\"1782472374\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Quay 3.1\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"quay/quay-rhel8\",\"cpes\":[\"cpe:/a:redhat:quay:3.10::el8\"],\"versions\":[{\"version\":\"1782487717\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Quay 3.12\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"quay/quay-rhel8\",\"cpes\":[\"cpe:/a:redhat:quay:3.12::el8\"],\"versions\":[{\"version\":\"1781937357\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Quay 3.15\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"quay/quay-rhel8\",\"cpes\":[\"cpe:/a:redhat:quay:3.15::el8\"],\"versions\":[{\"version\":\"1784351966\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Quay 3.16\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"quay/quay-rhel9\",\"cpes\":[\"cpe:/a:redhat:quay:3.16::el9\"],\"versions\":[{\"version\":\"1783955846\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Quay 3.9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"quay/quay-rhel8\",\"cpes\":[\"cpe:/a:redhat:quay:3.9::el8\"],\"versions\":[{\"version\":\"1781878070\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Satellite 6.18\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"satellite/iop-puptoo-rhel9\",\"cpes\":[\"cpe:/a:redhat:satellite:6.18::el9\"],\"versions\":[{\"version\":\"1779792651\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Satellite 6.18\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"satellite/iop-insights-engine-rhel9\",\"cpes\":[\"cpe:/a:redhat:satellite:6.18::el9\"],\"versions\":[{\"version\":\"1779711334\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Satellite 6.18\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"satellite/foreman-mcp-server-rhel9\",\"cpes\":[\"cpe:/a:redhat:satellite:6.18::el9\"],\"versions\":[{\"version\":\"1782739344\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Satellite 6.19\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"satellite/iop-vmaas-rhel9\",\"cpes\":[\"cpe:/a:redhat:satellite:6.19::el9\"],\"versions\":[{\"version\":\"1782139619\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Satellite 6.19\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"satellite/iop-puptoo-rhel9\",\"cpes\":[\"cpe:/a:redhat:satellite:6.19::el9\"],\"versions\":[{\"version\":\"1780393451\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Satellite 6.19\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"satellite/iop-yuptoo-rhel9\",\"cpes\":[\"cpe:/a:redhat:satellite:6.19::el9\"],\"versions\":[{\"version\":\"1782380482\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Satellite 6.19\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"satellite/iop-insights-engine-rhel9\",\"cpes\":[\"cpe:/a:redhat:satellite:6.19::el9\"],\"versions\":[{\"version\":\"1782448455\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Satellite 6.19\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"satellite/iop-advisor-backend-rhel9\",\"cpes\":[\"cpe:/a:redhat:satellite:6.19::el9\"],\"versions\":[{\"version\":\"1784558259\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Trusted Artifact Signer 1.3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhtas/segment-reporting-rhel9\",\"cpes\":[\"cpe:/a:redhat:trusted_artifact_signer:1.3::el9\"],\"versions\":[{\"version\":\"1780560117\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Trusted Artifact Signer 1.4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhtas/model-transparency-rhel9\",\"cpes\":[\"cpe:/a:redhat:trusted_artifact_signer:1.4::el9\"],\"versions\":[{\"version\":\"1780914886\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Update Infrastructure 5\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhui5/cds-kubernetes-rhel9\",\"cpes\":[\"cpe:/a:redhat:rhui:5::el9\"],\"versions\":[{\"version\":\"1784794818\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Update Infrastructure 5\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhui5/cds-rhel9\",\"cpes\":[\"cpe:/a:redhat:rhui:5::el9\"],\"versions\":[{\"version\":\"1784794778\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Update Infrastructure 5\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhui5/haproxy-rhel9\",\"cpes\":[\"cpe:/a:redhat:rhui:5::el9\"],\"versions\":[{\"version\":\"1784795112\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Update Infrastructure 5\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhui5/installer-rhel9\",\"cpes\":[\"cpe:/a:redhat:rhui:5::el9\"],\"versions\":[{\"version\":\"1784794289\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Update Infrastructure 5\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhui5/rhua-rhel9\",\"cpes\":[\"cpe:/a:redhat:rhui:5::el9\"],\"versions\":[{\"version\":\"1784795076\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Exploit Intelligence\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"exploit-intelligence-tech-preview/vulnerability-analysis-rhel9\",\"cpes\":[\"cpe:/a:redhat:exploit_intelligence:0\"]},{\"vendor\":\"Red Hat\",\"product\":\"External Secrets Operator for Red Hat OpenShift\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"external-secrets-operator/bitwarden-sdk-server-rhel9\",\"cpes\":[\"cpe:/a:redhat:external_secrets_operator:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"External Secrets Operator for Red Hat OpenShift\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"external-secrets-operator/external-secrets-operator-bundle\",\"cpes\":[\"cpe:/a:redhat:external_secrets_operator:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"External Secrets Operator for Red Hat OpenShift\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"external-secrets-operator/external-secrets-operator-rhel9\",\"cpes\":[\"cpe:/a:redhat:external_secrets_operator:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"External Secrets Operator for Red Hat OpenShift\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"external-secrets-operator/external-secrets-rhel9\",\"cpes\":[\"cpe:/a:redhat:external_secrets_operator:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Migration Toolkit for Applications 8\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"mta/mta-rhel9-operator\",\"cpes\":[\"cpe:/a:redhat:migration_toolkit_applications:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Migration Toolkit for Containers\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhmtc/openshift-migration-rhel8-operator\",\"cpes\":[\"cpe:/a:redhat:rhmt:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Migration Toolkit for Virtualization\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"migration-toolkit-virtualization/mtv-rhel9-operator\",\"cpes\":[\"cpe:/a:redhat:migration_toolkit_virtualization:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Migration Toolkit for Virtualization\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"mtv-candidate/mtv-rhel9-operator\",\"cpes\":[\"cpe:/a:redhat:migration_toolkit_virtualization:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Lightspeed\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift-lightspeed/lightspeed-ocp-rag-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_lightspeed\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Lightspeed\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift-lightspeed/lightspeed-service-api-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_lightspeed\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Lightspeed\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift-lightspeed/lightspeed-to-dataverse-exporter-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_lightspeed\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Service Mesh 3\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift-service-mesh/kiali-rhel9-operator\",\"cpes\":[\"cpe:/a:redhat:service_mesh:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Pen Drive Powered by Red Hat Lightspeed\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"pen-drive/pen-drive-scanner-rhel9\",\"cpes\":[\"cpe:/a:redhat:pdrive_lightspeed:0\",\"cpe:/a:redhat:pdrive_lightspeed:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat AI Inference Server\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhaiis/vllm-neuron-rhel9\",\"cpes\":[\"cpe:/a:redhat:ai_inference_server:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat AI Inference Server\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhaiis/vllm-tpu-rhel9\",\"cpes\":[\"cpe:/a:redhat:ai_inference_server:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"ansible-automation-platform-24/lightspeed-rhel8\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"ansible-automation-platform-25/ee-supported-rhel8\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"ansible-automation-platform-25/lightspeed-chatbot-rhel8\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"ansible-automation-platform-25/lightspeed-rhel8\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"ansible-automation-platform-26/eda-controller-rhel9-operator\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"ansible-automation-platform-26/ee-minimal-rhel9\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"ansible-automation-platform-26/ee-supported-rhel9\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"ansible-automation-platform-26/gateway-rhel9-operator\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"ansible-automation-platform-26/hub-rhel9-operator\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"ansible-automation-platform-26/lightspeed-rhel9\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"ansible-automation-platform-26/lightspeed-rhel9-operator\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"ansible-automation-platform-26/platform-resource-rhel9-operator\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"ansible-automation-platform-26/platform-resource-runner-rhel9\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"ansible-automation-platform/automation-dashboard-rhel9\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"ansible-automation-platform-tech-preview/metrics-service-rhel9-operator\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"python-urllib3\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Quarkus Native builder\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"urllib3\",\"cpes\":[\"cpe:/a:redhat:quarkus:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Developer Hub\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhdh/rhdh-hub-rhel9\",\"cpes\":[\"cpe:/a:redhat:rhdh:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"python3.14-pip\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"python-pip\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 6\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"python-urllib3\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:6\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 7\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"python-pip\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 7\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"python-s3transfer\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 7\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"python-urllib3\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"fence-agents\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"python3.11-pip\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"python3.12-pip\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"python-pip\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"python-urllib3\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"resource-agents\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"fence-agents\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"python3.11-pip\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"python3.12-pip\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"python3.14-pip\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"python-pip\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AI (RHEL AI) 3\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhelai3/bootc-aws-cuda-rhel9\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux_ai:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AI (RHEL AI) 3\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhelai3/bootc-azure-cuda-rhel9\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux_ai:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AI (RHEL AI) 3\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhelai3/bootc-azure-rocm-rhel9\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux_ai:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AI (RHEL AI) 3\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhelai3/bootc-cuda-rhel9\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux_ai:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AI (RHEL AI) 3\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhelai3/bootc-gcp-cuda-rhel9\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux_ai:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AI (RHEL AI) 3\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhelai3/bootc-rocm-rhel9\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux_ai:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AI (RHEL AI) 3\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhelai3/disk-image-cuda-rhel9\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux_ai:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Hardened Images\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"python-attrs\",\"cpes\":[\"cpe:/a:redhat:hummingbird:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-built-in-detector-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-caikit-nlp-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-caikit-tgis-serving-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-feature-server-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-guardrails-detector-huggingface-runtime-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-kserve-agent-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-kserve-controller-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-kserve-router-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-llm-d-inference-scheduler-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-ml-pipelines-runtime-generic-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-modelmesh-runtime-adapter-rhel8\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-openvino-model-server-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-trustyai-nemo-guardrails-server-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-vllm-gaudi-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-workbench-jupyter-minimal-rocm-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/rhai-cli-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift4/ose-agent-installer-api-server-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift4/ose-ansible-rhel9-operator\",\"cpes\":[\"cpe:/a:redhat:openshift:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift4/ose-olm-catalogd-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift4/ztp-site-generate-rhel8\",\"cpes\":[\"cpe:/a:redhat:openshift:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhcos\",\"cpes\":[\"cpe:/a:redhat:openshift:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Virtualization 4\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"container-native-virtualization/hyperconverged-cluster-operator-rhel9\",\"cpes\":[\"cpe:/a:redhat:container_native_virtualization:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Virtualization 4\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"container-native-virtualization/hyperconverged-cluster-webhook-rhel9\",\"cpes\":[\"cpe:/a:redhat:container_native_virtualization:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenStack Platform 17.1\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"python-urllib3\",\"cpes\":[\"cpe:/a:redhat:openstack:17.1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Satellite 6\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"python-urllib3\",\"cpes\":[\"cpe:/a:redhat:satellite:6\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Satellite 6\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"satellite-capsule:el8/python-urllib3\",\"cpes\":[\"cpe:/a:redhat:satellite:6\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Satellite 6\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"satellite/iop-advisor-engine-rhel9\",\"cpes\":[\"cpe:/a:redhat:satellite:6\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Satellite 6\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"satellite/iop-host-inventory-rhel9\",\"cpes\":[\"cpe:/a:redhat:satellite:6\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Satellite 6\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"satellite/iop-vulnerability-engine-rhel9\",\"cpes\":[\"cpe:/a:redhat:satellite:6\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Update Infrastructure 4 for Cloud Providers\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"python-urllib3\",\"cpes\":[\"cpe:/a:redhat:rhui:4::el8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Service Telemetry Framework 1.5\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"stf/service-telemetry-rhel9-operator\",\"cpes\":[\"cpe:/a:redhat:stf:1.5\"]},{\"vendor\":\"Red Hat\",\"product\":\"Service Telemetry Framework 1.5\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"stf/smart-gateway-rhel9-operator\",\"cpes\":[\"cpe:/a:redhat:stf:1.5\"]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":8.9,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"PRESENT\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"NONE\",\"vulnAvailabilityImpact\":\"HIGH\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"HIGH\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-05-15T18:17:39.119999Z\",\"id\":\"CVE-2026-44432\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-409\"}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-409\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:python:urllib3:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.6.0\",\"versionEndExcluding\":\"2.7.0\",\"matchCriteriaId\":\"2B9D0BE5-DF70-4B46-8128-324E04104B1B\"}]}]}],\"references\":[{\"url\":\"https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Mitigation\",\"Vendor Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:15862\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:20338\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:22934\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:24000\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:24009\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:24014\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:24069\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:24374\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:24476\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:24483\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:24540\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:24541\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:24542\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:24544\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:25039\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:25143\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:25928\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:26212\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:26304\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:27929\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:28000\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:28157\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:28158\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:28159\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:28571\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:30076\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:30078\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:30087\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:30088\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:30089\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:32992\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:33313\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:33683\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:34160\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:34374\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:34526\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:34531\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:34533\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:34607\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:36350\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:37275\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:41066\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:42078\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:42079\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:42132\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:42144\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:42644\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:42796\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:43038\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:44481\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:51206\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:7625\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:7634\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/security/cve/CVE-2026-44432\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=2477154\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44432.json\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"}]}}",
"redhat_vex": {
"aggregate_severity": "Important",
"current_release_date": "2026-08-11T20:37:37+00:00",
"cve": "CVE-2026-44432",
"id": "CVE-2026-44432",
"initial_release_date": "2026-05-13T15:17:12.611000+00:00",
"product_status:fixed": "192",
"product_status:known_affected": "48",
"product_status:known_not_affected": "1487",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44432.json",
"version": "3"
},
"suse_vex": {
"aggregate_severity": "moderate",
"current_release_date": "2026-07-28T17:15:51Z",
"cve": "CVE-2026-44432",
"id": "CVE-2026-44432",
"initial_release_date": "2026-05-15T01:58:06Z",
"product_status:known_not_affected": "134",
"product_status:recommended": "9",
"source": "SUSE CSAF VEX",
"status": "interim",
"title": "SUSE CVE CVE-2026-44432",
"url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-44432.json",
"version": "5"
},
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"urllib3: urllib3: Denial of Service due to excessive HTTP response decompression\", \"metrics\": [{\"other\": {\"type\": \"Red Hat severity rating\", \"content\": {\"value\": \"Important\", \"namespace\": \"https://access.redhat.com/security/updates/classification/\"}}}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2.5::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2.5 for RHEL 8\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:4.6.30-2.el8ap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"automation-controller\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2.5::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2.5 for RHEL 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:4.6.30-2.el9ap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"automation-controller\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2.6::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2.6 for RHEL 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:2.7.0-1.el9ap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"python3.12-urllib3\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2.6::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2.6 for RHEL 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:4.7.14-3.el9ap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"automation-controller\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10.2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:2.6.3-2.el10_2\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"python3.14-urllib3\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10.2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:1.26.19-4.el10_2\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"python-urllib3\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:1.26.19-3.el8_10\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"python3.12-urllib3\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:2.6.3-2.el9_8\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"python3.14-urllib3\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:1.26.19-3.el9_8\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"python3.12-urllib3\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:1.26.5-8.el9_8\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"python-urllib3\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ai_inference_server:3.3::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat AI Inference Server 3.3\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1782352950\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhaiis/model-opt-cuda-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ai_inference_server:3.3::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat AI Inference Server 3.3\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1782352919\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhaiis/vllm-spyre-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ai_inference_server:3.3::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat AI Inference Server 3.3\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1782353093\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhaiis/vllm-rocm-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ai_inference_server:3.3::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat AI Inference Server 3.3\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1782352847\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhaiis/vllm-cuda-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ai_inference_server:3.4::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat AI Inference Server 3.4\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1780356811\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhaii/vllm-cpu-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ai_inference_server:3.4::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat AI Inference Server 3.4\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1780356904\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhaii/vllm-spyre-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ai_inference_server:3.4::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat AI Inference Server 3.4\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1780356941\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhaii/model-opt-cuda-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ai_inference_server:3.4::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat AI Inference Server 3.4\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1780356914\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhaii/vllm-cuda-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2.5::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2.5\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1784050598\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ansible-automation-platform-25/hub-rhel8\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2.6::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2.6\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1782761510\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ansible-automation-platform-26/gateway-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2.6::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2.6\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1782650747\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ansible-automation-platform-26/lightspeed-chatbot-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2.6::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2.6\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1783973764\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ansible-automation-platform-26/controller-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2.6::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2.6\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1783921549\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ansible-automation-platform-26/de-minimal-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2.6::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2.6\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1783923629\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ansible-automation-platform-26/de-supported-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2.6::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2.6\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1783969139\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ansible-automation-platform-tech-preview/metrics-service-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2.7::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2.7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1781028735\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ansible-automation-platform-27/eda-controller-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2.7::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2.7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1781102816\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ansible-automation-platform-27/hub-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:discovery:2::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Discovery 2\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1779395228\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"discovery/discovery-server-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:discovery:2::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Discovery 2\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1782756541\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"discovery/discovery-ui-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:hummingbird:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Hardened Images\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0.69.3-1.2.hum1\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"trivy-main\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:hummingbird:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Hardened Images\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1.96.0-1.hum1\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rust-main\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:hummingbird:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Hardened Images\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1.2.1-2.hum1\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"python-trustme-main\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:hummingbird:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Hardened Images\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"2.7.0-3.hum1\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"python-urllib3-main\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:hummingbird:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Hardened Images\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"48.0.0-3.hum1\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"python-cryptography-main\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:hummingbird:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Hardened Images\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"21.1.8-6.hum1\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"llvm21-main\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:hummingbird:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Hardened Images\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"2026.5.1-1.hum1\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"python-rpds-py-main\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:hummingbird:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Hardened Images\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"2.19.0-1.hum1\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"jaeger-main\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:hummingbird:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Hardened Images\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"11.8.8-1.hum1\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"mariadb11-8-main\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:hummingbird:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Hardened Images\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"2.48.0-4.1.hum1\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"python-sentry-sdk-main\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:hummingbird:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Hardened Images\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"21.1.8-1.1.hum1\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"llvm-main\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:migration_toolkit_applications:8.2::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Migration Toolkit for Applications 8.2\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1784109883\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"mta/mta-solution-server-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai:2.25::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI 2.25\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1783024305\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhoai/odh-kserve-storage-initializer-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai:2.25::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI 2.25\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1783701598\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhoai/odh-llama-stack-core-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai:2.25::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI 2.25\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1783342900\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhoai/odh-modelmesh-runtime-adapter-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai:2.25::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI 2.25\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1783112979\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhoai/odh-model-registry-job-async-upload-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai:2.25::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI 2.25\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1783091175\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhoai/odh-ta-lmes-job-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai:2.25::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI 2.25\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1783998774\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhoai/odh-vllm-cuda-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai:2.25::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI 2.25\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1783998857\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhoai/odh-vllm-rocm-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai:3.3::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI 3.3\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1783010225\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhoai/odh-kserve-storage-initializer-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai:3.3::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI 3.3\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1782917849\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhoai/odh-mlflow-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai:3.3::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI 3.3\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1782887848\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhoai/odh-mlserver-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai:3.3::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI 3.3\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1782854229\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhoai/odh-model-registry-job-async-upload-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai:3.3::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI 3.3\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1782471555\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhoai/odh-training-cuda121-torch24-py311-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai:3.3::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI 3.3\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1782471579\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhoai/odh-training-cuda124-torch25-py311-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai:3.3::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI 3.3\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1783073038\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhoai/odh-training-cuda128-torch28-py312-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai:3.3::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI 3.3\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1782991170\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhoai/odh-training-cuda128-torch29-py312-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai:3.3::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI 3.3\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1782471656\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhoai/odh-training-rocm62-torch24-py311-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai:3.3::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI 3.3\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1782471663\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhoai/odh-training-rocm62-torch25-py311-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai:3.3::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI 3.3\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1783069204\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhoai/odh-training-rocm64-torch28-py312-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai:3.3::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI 3.3\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1782991170\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhoai/odh-training-rocm64-torch29-py312-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai:3.3::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI 3.3\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1782472374\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhoai/odh-trustyai-garak-lls-provider-dsp-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:quay:3.10::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Quay 3.1\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1782487717\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"quay/quay-rhel8\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:quay:3.12::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Quay 3.12\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1781937357\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"quay/quay-rhel8\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:quay:3.15::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Quay 3.15\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1784351966\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"quay/quay-rhel8\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:quay:3.16::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Quay 3.16\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1783955846\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"quay/quay-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:quay:3.9::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Quay 3.9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1781878070\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"quay/quay-rhel8\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite:6.18::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6.18\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1779792651\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"satellite/iop-puptoo-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite:6.18::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6.18\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1779711334\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"satellite/iop-insights-engine-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite:6.18::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6.18\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1782739344\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"satellite/foreman-mcp-server-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite:6.19::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6.19\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1782139619\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"satellite/iop-vmaas-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite:6.19::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6.19\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1780393451\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"satellite/iop-puptoo-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite:6.19::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6.19\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1782380482\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"satellite/iop-yuptoo-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite:6.19::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6.19\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1782448455\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"satellite/iop-insights-engine-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite:6.19::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6.19\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1784558259\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"satellite/iop-advisor-backend-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:trusted_artifact_signer:1.3::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Trusted Artifact Signer 1.3\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1780560117\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhtas/segment-reporting-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:trusted_artifact_signer:1.4::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Trusted Artifact Signer 1.4\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1780914886\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhtas/model-transparency-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhui:5::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Update Infrastructure 5\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1784794818\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhui5/cds-kubernetes-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhui:5::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Update Infrastructure 5\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1784794778\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhui5/cds-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhui:5::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Update Infrastructure 5\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1784795112\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhui5/haproxy-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhui:5::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Update Infrastructure 5\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1784794289\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhui5/installer-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhui:5::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Update Infrastructure 5\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1784795076\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhui5/rhua-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:exploit_intelligence:0\"], \"vendor\": \"Red Hat\", \"product\": \"Exploit Intelligence\", \"packageName\": \"exploit-intelligence-tech-preview/vulnerability-analysis-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:external_secrets_operator:1\"], \"vendor\": \"Red Hat\", \"product\": \"External Secrets Operator for Red Hat OpenShift\", \"packageName\": \"external-secrets-operator/bitwarden-sdk-server-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:external_secrets_operator:1\"], \"vendor\": \"Red Hat\", \"product\": \"External Secrets Operator for Red Hat OpenShift\", \"packageName\": \"external-secrets-operator/external-secrets-operator-bundle\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:external_secrets_operator:1\"], \"vendor\": \"Red Hat\", \"product\": \"External Secrets Operator for Red Hat OpenShift\", \"packageName\": \"external-secrets-operator/external-secrets-operator-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:external_secrets_operator:1\"], \"vendor\": \"Red Hat\", \"product\": \"External Secrets Operator for Red Hat OpenShift\", \"packageName\": \"external-secrets-operator/external-secrets-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:migration_toolkit_applications:8\"], \"vendor\": \"Red Hat\", \"product\": \"Migration Toolkit for Applications 8\", \"packageName\": \"mta/mta-rhel9-operator\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhmt:1\"], \"vendor\": \"Red Hat\", \"product\": \"Migration Toolkit for Containers\", \"packageName\": \"rhmtc/openshift-migration-rhel8-operator\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:migration_toolkit_virtualization:2\"], \"vendor\": \"Red Hat\", \"product\": \"Migration Toolkit for Virtualization\", \"packageName\": \"migration-toolkit-virtualization/mtv-rhel9-operator\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:migration_toolkit_virtualization:2\"], \"vendor\": \"Red Hat\", \"product\": \"Migration Toolkit for Virtualization\", \"packageName\": \"mtv-candidate/mtv-rhel9-operator\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_lightspeed\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Lightspeed\", \"packageName\": \"openshift-lightspeed/lightspeed-ocp-rag-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_lightspeed\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Lightspeed\", \"packageName\": \"openshift-lightspeed/lightspeed-service-api-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_lightspeed\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Lightspeed\", \"packageName\": \"openshift-lightspeed/lightspeed-to-dataverse-exporter-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:service_mesh:3\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Service Mesh 3\", \"packageName\": \"openshift-service-mesh/kiali-rhel9-operator\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:pdrive_lightspeed:0\", \"cpe:/a:redhat:pdrive_lightspeed:1\"], \"vendor\": \"Red Hat\", \"product\": \"Pen Drive Powered by Red Hat Lightspeed\", \"packageName\": \"pen-drive/pen-drive-scanner-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ai_inference_server:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat AI Inference Server\", \"packageName\": \"rhaiis/vllm-neuron-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ai_inference_server:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat AI Inference Server\", \"packageName\": \"rhaiis/vllm-tpu-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2\", \"packageName\": \"ansible-automation-platform-24/lightspeed-rhel8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2\", \"packageName\": \"ansible-automation-platform-25/ee-supported-rhel8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2\", \"packageName\": \"ansible-automation-platform-25/lightspeed-chatbot-rhel8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2\", \"packageName\": \"ansible-automation-platform-25/lightspeed-rhel8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2\", \"packageName\": \"ansible-automation-platform-26/eda-controller-rhel9-operator\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2\", \"packageName\": \"ansible-automation-platform-26/ee-minimal-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2\", \"packageName\": \"ansible-automation-platform-26/ee-supported-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2\", \"packageName\": \"ansible-automation-platform-26/gateway-rhel9-operator\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2\", \"packageName\": \"ansible-automation-platform-26/hub-rhel9-operator\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2\", \"packageName\": \"ansible-automation-platform-26/lightspeed-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2\", \"packageName\": \"ansible-automation-platform-26/lightspeed-rhel9-operator\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2\", \"packageName\": \"ansible-automation-platform-26/platform-resource-rhel9-operator\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2\", \"packageName\": \"ansible-automation-platform-26/platform-resource-runner-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2\", \"packageName\": \"ansible-automation-platform/automation-dashboard-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2\", \"packageName\": \"ansible-automation-platform-tech-preview/metrics-service-rhel9-operator\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2\", \"packageName\": \"python-urllib3\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:quarkus:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Quarkus Native builder\", \"packageName\": \"urllib3\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:rhdh:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Developer Hub\", \"packageName\": \"rhdh/rhdh-hub-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"packageName\": \"python3.14-pip\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"packageName\": \"python-pip\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 6\", \"packageName\": \"python-urllib3\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 7\", \"packageName\": \"python-pip\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 7\", \"packageName\": \"python-s3transfer\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 7\", \"packageName\": \"python-urllib3\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8\", \"packageName\": \"fence-agents\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8\", \"packageName\": \"python3.11-pip\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8\", \"packageName\": \"python3.12-pip\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8\", \"packageName\": \"python-pip\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8\", \"packageName\": \"python-urllib3\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8\", \"packageName\": \"resource-agents\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"packageName\": \"fence-agents\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"packageName\": \"python3.11-pip\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"packageName\": \"python3.12-pip\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"packageName\": \"python3.14-pip\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"packageName\": \"python-pip\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux_ai:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AI (RHEL AI) 3\", \"packageName\": \"rhelai3/bootc-aws-cuda-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux_ai:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AI (RHEL AI) 3\", \"packageName\": \"rhelai3/bootc-azure-cuda-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux_ai:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AI (RHEL AI) 3\", \"packageName\": \"rhelai3/bootc-azure-rocm-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux_ai:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AI (RHEL AI) 3\", \"packageName\": \"rhelai3/bootc-cuda-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux_ai:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AI (RHEL AI) 3\", \"packageName\": \"rhelai3/bootc-gcp-cuda-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux_ai:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AI (RHEL AI) 3\", \"packageName\": \"rhelai3/bootc-rocm-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux_ai:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AI (RHEL AI) 3\", \"packageName\": \"rhelai3/disk-image-cuda-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:hummingbird:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Hardened Images\", \"packageName\": \"python-attrs\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-built-in-detector-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-caikit-nlp-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-caikit-tgis-serving-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-feature-server-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-guardrails-detector-huggingface-runtime-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-kserve-agent-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-kserve-controller-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-kserve-router-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-llm-d-inference-scheduler-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-ml-pipelines-runtime-generic-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-modelmesh-runtime-adapter-rhel8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-openvino-model-server-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-trustyai-nemo-guardrails-server-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-vllm-gaudi-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-workbench-jupyter-minimal-rocm-py312-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/rhai-cli-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4\", \"packageName\": \"openshift4/ose-agent-installer-api-server-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4\", \"packageName\": \"openshift4/ose-ansible-rhel9-operator\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4\", \"packageName\": \"openshift4/ose-olm-catalogd-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4\", \"packageName\": \"openshift4/ztp-site-generate-rhel8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4\", \"packageName\": \"rhcos\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:container_native_virtualization:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Virtualization 4\", \"packageName\": \"container-native-virtualization/hyperconverged-cluster-operator-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:container_native_virtualization:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Virtualization 4\", \"packageName\": \"container-native-virtualization/hyperconverged-cluster-webhook-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openstack:17.1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenStack Platform 17.1\", \"packageName\": \"python-urllib3\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite:6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6\", \"packageName\": \"python-urllib3\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite:6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6\", \"packageName\": \"satellite-capsule:el8/python-urllib3\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite:6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6\", \"packageName\": \"satellite/iop-advisor-engine-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite:6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6\", \"packageName\": \"satellite/iop-host-inventory-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite:6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6\", \"packageName\": \"satellite/iop-vulnerability-engine-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:rhui:4::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Update Infrastructure 4 for Cloud Providers\", \"packageName\": \"python-urllib3\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:stf:1.5\"], \"vendor\": \"Red Hat\", \"product\": \"Service Telemetry Framework 1.5\", \"packageName\": \"stf/service-telemetry-rhel9-operator\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:stf:1.5\"], \"vendor\": \"Red Hat\", \"product\": \"Service Telemetry Framework 1.5\", \"packageName\": \"stf/smart-gateway-rhel9-operator\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-05-13T17:01:01.083Z\", \"value\": \"Reported to Red Hat.\"}, {\"lang\": \"en\", \"time\": \"2026-05-13T15:17:12.611Z\", \"value\": \"Made public.\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"RHSA-2026:42078: Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:34160: Red Hat Ansible Automation Platform 2.6 for RHEL 9\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:42079: Red Hat Ansible Automation Platform 2.6 for RHEL 9\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:27929: Red Hat Enterprise Linux AppStream (v. 10)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:32992: Red Hat Enterprise Linux AppStream (v. 8)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:28159: Red Hat Enterprise Linux AppStream (v. 9)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:28157: Red Hat Enterprise Linux AppStream (v. 9)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:28000: Red Hat Enterprise Linux BaseOS (v. 10)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:28158: Red Hat Enterprise Linux BaseOS (v. 9)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:30078: Red Hat AI Inference Server 3.3\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:30089: Red Hat AI Inference Server 3.3\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:30088: Red Hat AI Inference Server 3.3\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:30087: Red Hat AI Inference Server 3.3\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:24542: Red Hat AI Inference Server 3.4\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:24540: Red Hat AI Inference Server 3.4\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:24544: Red Hat AI Inference Server 3.4\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:24541: Red Hat AI Inference Server 3.4\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:42144: Red Hat Ansible Automation Platform 2.5\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:42132: Red Hat Ansible Automation Platform 2.6\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:34374: Red Hat Ansible Automation Platform 2.6\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:25928: Red Hat Ansible Automation Platform 2.7\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:20338: Red Hat Discovery 2\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:33313: Red Hat Discovery 2\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:25039: Red Hat Hardened Images\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:7634: Red Hat Hardened Images\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:24069: Red Hat Hardened Images\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:25143: Red Hat Hardened Images\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:24014: Red Hat Hardened Images\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:24374: Red Hat Hardened Images\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:7625: Red Hat Hardened Images\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:24000: Red Hat Hardened Images\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:24009: Red Hat Hardened Images\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:22934: Red Hat Hardened Images\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:15862: Red Hat Hardened Images\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:43038: Red Hat Migration Toolkit for Applications 8.2\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:42644: Red Hat OpenShift AI 2.25\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:37275: Red Hat OpenShift AI 3.3\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:30076: Red Hat Quay 3.12\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:42796: Red Hat Quay 3.15\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:41066: Red Hat Quay 3.16\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:33683: Red Hat Quay 3.1\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:28571: Red Hat Quay 3.9\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:36350: Red Hat Satellite 6.18\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:26304: Red Hat Satellite 6.18\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:26212: Red Hat Satellite 6.18\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:51206: Red Hat Satellite 6.19\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:34607: Red Hat Satellite 6.19\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:34531: Red Hat Satellite 6.19\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:34526: Red Hat Satellite 6.19\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:34533: Red Hat Satellite 6.19\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:24476: Red Hat Trusted Artifact Signer 1.3\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:24483: Red Hat Trusted Artifact Signer 1.4\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:44481: Red Hat Update Infrastructure 5\"}], \"x_adpType\": \"supplier\", \"datePublic\": \"2026-05-13T15:17:12.611Z\", \"references\": [{\"url\": \"https://access.redhat.com/security/cve/CVE-2026-44432\", \"tags\": [\"vdb-entry\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=2477154\", \"name\": \"RHBZ#2477154\", \"tags\": [\"issue-tracking\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44432.json\", \"tags\": [\"x_sadp-csaf-vex\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:42078\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:34160\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:42079\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:27929\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:32992\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:28159\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:28157\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:28000\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:28158\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:30078\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:30089\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:30088\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:30087\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:24542\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:24540\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:24544\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:24541\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:42144\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:42132\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:34374\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:25928\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:20338\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:33313\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:25039\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:7634\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:24069\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:25143\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:24014\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:24374\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:7625\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:24000\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:24009\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:22934\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:15862\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:43038\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:42644\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:37275\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:30076\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:42796\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:41066\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:33683\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:28571\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:36350\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:26304\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:26212\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:51206\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:34607\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:34531\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:34526\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:34533\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:24476\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:24483\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:44481\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}], \"x_generator\": {\"engine\": \"sadp-cli 1.0.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A flaw was found in urllib3, an HTTP client library for Python. This vulnerability allows a remote attacker to cause excessive resource consumption, such as high CPU usage and massive memory allocation, on the client side. This occurs when urllib3 attempts to decompress an entire HTTP response, even if only a partial read was requested, or when draining the connection after a partial decompression. This can lead to a Denial of Service (DoS) condition.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-409\", \"description\": \"Improper Handling of Highly Compressed Data (Data Amplification)\"}]}], \"providerMetadata\": {\"orgId\": \"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\", \"shortName\": \"redhat-SADP\", \"dateUpdated\": \"2026-08-10T12:05:44.180Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-44432\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-05-15T18:17:39.119999Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-05-15T18:25:01.877Z\"}}], \"cna\": {\"title\": \"urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API\", \"source\": {\"advisory\": \"GHSA-mf9v-mfxr-j63j\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 8.9, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"PRESENT\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"NONE\", \"subAvailabilityImpact\": \"HIGH\", \"vulnAvailabilityImpact\": \"HIGH\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"urllib3\", \"product\": \"urllib3\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 2.6.0, \u003c 2.7.0\"}]}], \"references\": [{\"url\": \"https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j\", \"name\": \"https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j\", \"tags\": [\"x_refsource_CONFIRM\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"urllib3 is an HTTP client library for Python. From 2.6.0 to before 2.7.0, urllib3 could decompress the whole response instead of the requested portion (1) during the second HTTPResponse.read(amt=N) call when the response was decompressed using the official Brotli library or (2) when HTTPResponse.drain_conn() was called after the response had been read and decompressed partially (compression algorithm did not matter here). These issues could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This could result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data) on the client side. This vulnerability is fixed in 2.7.0.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-409\", \"description\": \"CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-05-13T15:17:12.611Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-44432\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-10T12:05:44.180Z\", \"dateReserved\": \"2026-05-06T14:40:00.954Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-05-13T15:17:12.611Z\", \"assignerShortName\": \"GitHub_M\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
RHSA-2026:42796
Vulnerability from csaf_redhat - Published: 2026-07-21 13:53 - Updated: 2026-08-12 04:29Summary
Red Hat Security Advisory: Red Hat Quay 3.15.6
Severity
Important
Notes
Topic: Red Hat Quay 3.15.6 is now available with bug fixes.
Details: Quay 3.15.6
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in the shell-quote component. The quote() function did not properly validate object-token inputs, allowing line terminators to pass unescaped into the output. A remote attacker could exploit this vulnerability by providing specially crafted input, which a POSIX shell would interpret as a command separator. This could lead to command injection, enabling the attacker to execute arbitrary code on the system.
8.1 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le | — |
Vendor Fix
fix
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le | — |
Threats
Impact
Important
A flaw was found in kafka-python. A malicious or machine-in-the-middle broker could exploit a denial-of-service vulnerability during SCRAM authentication. By providing an excessively large iteration count, the broker can cause the client's event loop to freeze. This prevents critical operations such as sending messages, polling for new messages, and maintaining heartbeats, ultimately leading to consumer group eviction and persistent connection failures.
7.5 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in form-data, a library for creating readable multipart/form-data streams. A remote attacker can exploit this vulnerability by injecting carriage return (CR), line feed (LF), or double-quote (") characters into the `field` argument of `FormData#append` or the `filename` option. This allows the attacker to inject additional headers or smuggle entire additional multipart parts into requests, potentially enabling them to add or override form fields and compromise data integrity.
7.5 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Red Hat Quay's Proxy Cache configuration feature. When an organization administrator configures an upstream registry for proxy caching, Quay makes a network connection to the specified registry hostname without verifying that it points to a legitimate external service. An attacker with organization administrator privileges could supply a crafted hostname to force the Quay server to make requests to internal network services, cloud infrastructure endpoints, or other resources that should not be accessible from the Quay application.
5.2 (Medium)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le | — |
Vendor Fix
fix
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le | — |
Threats
Impact
Important
A flaw was found in the `net/mail` package of the Go programming language. An attacker could provide specially crafted inputs to the `ParseAddress`, `ParseAddressList`, or `ParseDate` functions. This could lead to excessive consumption of CPU and memory resources, resulting in a Denial of Service (DoS) for applications processing these inputs.
7.5 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname (for example, xn--example-.com returns example.com instead of an error). Applications that validate the ASCII form then convert to Unicode may grant access to a restricted hostname the ASCII check would have rejected.
8.2 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/crypto/ssh. A remote attacker could exploit this vulnerability when an SSH server authentication callback returned a PartialSuccessError with non-nil permissions. This flaw caused these permissions to be silently discarded, potentially bypassing certificate restrictions, such as a force-command, after a second authentication factor succeeded. This could lead to unauthorized command execution or access.
8.8 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/crypto/ssh. The RSA and DSA public key parsers in the affected component did not enforce size limits on key parameters. This vulnerability allows an unauthenticated client to provide a crafted public key with an excessively large modulus or DSA parameter during public key authentication. Successful exploitation could lead to a denial of service (DoS) due to prolonged CPU consumption during signature verification.
7.5 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/crypto/ssh. A remote malicious SSH peer can exploit this by sending unsolicited global request responses, which fills an internal buffer and blocks the connection's read loop. This prevents the associated resources from being released, leading to a resource leak per connection. The consequence is a Denial of Service (DoS) for the affected system.
7.5 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/crypto/ssh. The Verify() method, responsible for FIDO/U2F security key types, did not properly check for user presence. This allowed signatures to be accepted without requiring a physical touch on the hardware security key. As a result, an attacker could potentially use a hardware security key in an unattended manner, bypassing a critical security control designed to ensure user intent.
8.1 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le | — |
Vendor Fix
fix
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le | — |
Threats
Impact
Important
A flaw was found in golang.org/x/crypto/ssh/agent. When a key was added to a remote agent, security restrictions, known as constraint extensions, were not properly processed during the request. This allowed these restrictions to be silently removed when keys were forwarded, leading to the unrestricted use of the key on the remote host. This vulnerability could enable an attacker to bypass intended security controls and perform unauthorized actions.
8.7 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/crypto/ssh. SSH servers configured to use CertChecker as a public key callback, without explicitly setting IsUserAuthority or IsHostAuthority, are vulnerable. A remote attacker can exploit this by presenting a specially crafted certificate, causing the server to panic and resulting in a Denial of Service (DoS).
7.5 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Prometheus, an open-source monitoring system. The `client_secret` field within the Azure Active Directory (AD) remote write OAuth configuration was incorrectly handled as a plain string instead of a secure Secret type. This misconfiguration allowed any user or process with access to the `/-/config` HTTP API endpoint to view the Azure OAuth client secret in plaintext. This vulnerability leads to information disclosure, potentially compromising the security of integrated Azure AD services.
7.5 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le | — |
Vendor Fix
fix
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le | — |
Threats
Impact
Important
A flaw was found in Prometheus. An unauthenticated attacker can exploit the remote read endpoint (`/api/v1/read`) by sending a specially crafted, small snappy-compressed payload. This payload causes a disproportionately large memory allocation, leading to memory exhaustion and a Denial of Service (DoS) by crashing the Prometheus process.
7.5 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le | — |
Vendor Fix
fix
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le | — |
Threats
Impact
Important
A flaw was found in the `net/mail` package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the `consumePhrase` function, it can lead to excessive resource consumption due to quadratic string concatenation, resulting in a Denial of Service (DoS) condition.
7.5 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/crypto/ssh/knownhosts. This vulnerability occurs because the system did not correctly check for the revocation status of a SignatureKey belonging to a Certificate Authority (CA). A remote attacker could potentially exploit this by presenting a revoked key, leading to the system accepting it as valid. This could allow an attacker to bypass security checks and potentially gain unauthorized access or spoof legitimate entities.
7.4 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le | — |
Vendor Fix
fix
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le | — |
Threats
Impact
Important
A flaw was found in urllib3, an HTTP client library for Python. This vulnerability allows a remote attacker to cause excessive resource consumption, such as high CPU usage and massive memory allocation, on the client side. This occurs when urllib3 attempts to decompress an entire HTTP response, even if only a partial read was requested, or when draining the connection after a partial decompression. This can lead to a Denial of Service (DoS) condition.
7.5 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le | — |
Vendor Fix
fix
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le | — |
Threats
Impact
Important
A flaw was found in Axios, a promise-based HTTP client, specifically in its Node.js HTTP adapter. When Axios is configured to use an authenticated proxy and follows a redirect, it may inadvertently send the Proxy-Authorization header, containing proxy credentials, to the redirect target. This can lead to the disclosure of sensitive proxy credentials to an unintended remote server.
7.5 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Axios. During specific proxy-to-direct redirect flows in the Node.js HTTP adapter, a remote attacker could exploit this vulnerability. The Proxy-Authorization header, which contains proxy credentials and is intended only for the outbound proxy, may be forwarded to the final redirected origin. This can lead to the disclosure of sensitive proxy credentials to an unintended third party.
7.5 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Axios, a promise-based HTTP client. When using the fetch adapter, Axios did not properly enforce configured request and response size limits. This vulnerability allows a remote attacker, through a malicious or compromised server, or by supplying a large data URL, to send or receive oversized data bodies. This can lead to resource exhaustion in server-side applications, resulting in a Denial of Service (DoS).
7.5 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Axios, a promise-based HTTP client. This vulnerability occurs because Axios does not properly normalize IPv4-mapped IPv6 addresses. When a NO_PROXY setting is configured to block direct access to specific IPv4 addresses, an attacker can bypass this restriction by using the IPv4-mapped IPv6 form of the address in a request URL. This allows the request to be routed through the proxy, potentially exposing internal services or sensitive information that should otherwise be inaccessible.
8.6 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Axios. This vulnerability, a Prototype Pollution "Gadget" attack, allows an attacker to escalate any existing Object.prototype pollution in an application's dependency tree into a full Man-in-the-Middle (MITM) attack. This enables the attacker to intercept, read, and modify all HTTP traffic, including sensitive authentication credentials. The flaw occurs because the `config.proxy` setting is susceptible to prototype pollution, allowing an attacker to inject a malicious proxy server.
8.7 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Axios, a promise-based HTTP client. This vulnerability involves prototype pollution gadgets in the request configuration processing. If another vulnerability has already polluted the Object.prototype.transformResponse, affected Axios versions may incorrectly interpret this inherited value as part of the request configuration or as an option validator. Axios does not itself create the prototype pollution. Exploitability requires a separate prototype-pollution vulnerability or equivalent attacker control over Object.prototype before Axios creates a request.
7.0 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Axios. A remote attacker, by influencing the XSRF cookie name in a browser environment, could cause the application to construct a regular expression that leads to excessive processing. This can result in a client-side Denial of Service (DoS), where the affected browser tab may freeze, impacting the availability of the application for the user.
7.5 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the `sanitize-html` library. Under its default configuration, an attacker can embed malicious content within a disallowed `xmp` element. This vulnerability allows the attacker to bypass the HTML sanitization process, leading to stored Cross-Site Scripting (XSS). Successful exploitation can result in arbitrary code execution or information disclosure when a user views the affected content.
8.1 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/crypto/ssh. Source-address validation can be skipped when an SSH server configuration uses an authentication callback type other than public key, allowing authorization bypass in misconfigured servers. This is a follow-on to incomplete coverage from the CVE-2024-45337 fix.
7.1 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/crypto/ssh. A remote attacker could send specially crafted inputs to the AES-GCM packet decoder. This could lead to an incorrectly placed cast from bytes to an integer, causing a server-side panic and resulting in a Denial of Service (DoS) for the affected system.
7.5 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le | — |
Workaround
|
Threats
Impact
Important
A flaw was found in PyJWT, a Python library for JSON Web Token (JWT) implementation. When decoding JWTs, the library fails to validate the use of JSON Web Keys (JWK) in the HMAC algorithm while also supporting asymmetric algorithms. This allows a remote attacker to use the issuer's public key as the secret key for the HMAC algorithm, leading to the ability to forge JWTs. This vulnerability can result in authentication bypass or unauthorized access.
7.4 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le | — |
Vendor Fix
fix
|
Known not affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64 | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x | — | ||
| Unresolved product id: Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le | — |
Threats
Impact
Important
References
217 references
Acknowledgments
Antony Di Scala
Michael Whale
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat Quay 3.15.6 is now available with bug fixes.",
"title": "Topic"
},
{
"category": "general",
"text": "Quay 3.15.6",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:42796",
"url": "https://access.redhat.com/errata/RHSA-2026:42796"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-10143",
"url": "https://access.redhat.com/security/cve/CVE-2026-10143"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-12143",
"url": "https://access.redhat.com/security/cve/CVE-2026-12143"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32591",
"url": "https://access.redhat.com/security/cve/CVE-2026-32591"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39820",
"url": "https://access.redhat.com/security/cve/CVE-2026-39820"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39821",
"url": "https://access.redhat.com/security/cve/CVE-2026-39821"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39828",
"url": "https://access.redhat.com/security/cve/CVE-2026-39828"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39829",
"url": "https://access.redhat.com/security/cve/CVE-2026-39829"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39830",
"url": "https://access.redhat.com/security/cve/CVE-2026-39830"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39831",
"url": "https://access.redhat.com/security/cve/CVE-2026-39831"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39832",
"url": "https://access.redhat.com/security/cve/CVE-2026-39832"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39835",
"url": "https://access.redhat.com/security/cve/CVE-2026-39835"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42151",
"url": "https://access.redhat.com/security/cve/CVE-2026-42151"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42154",
"url": "https://access.redhat.com/security/cve/CVE-2026-42154"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42499",
"url": "https://access.redhat.com/security/cve/CVE-2026-42499"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42508",
"url": "https://access.redhat.com/security/cve/CVE-2026-42508"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-44432",
"url": "https://access.redhat.com/security/cve/CVE-2026-44432"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-44486",
"url": "https://access.redhat.com/security/cve/CVE-2026-44486"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-44487",
"url": "https://access.redhat.com/security/cve/CVE-2026-44487"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-44488",
"url": "https://access.redhat.com/security/cve/CVE-2026-44488"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-44492",
"url": "https://access.redhat.com/security/cve/CVE-2026-44492"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-44494",
"url": "https://access.redhat.com/security/cve/CVE-2026-44494"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-44495",
"url": "https://access.redhat.com/security/cve/CVE-2026-44495"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-44496",
"url": "https://access.redhat.com/security/cve/CVE-2026-44496"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-44990",
"url": "https://access.redhat.com/security/cve/CVE-2026-44990"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-46595",
"url": "https://access.redhat.com/security/cve/CVE-2026-46595"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-46597",
"url": "https://access.redhat.com/security/cve/CVE-2026-46597"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-48526",
"url": "https://access.redhat.com/security/cve/CVE-2026-48526"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-9277",
"url": "https://access.redhat.com/security/cve/CVE-2026-9277"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_42796.json"
}
],
"title": "Red Hat Security Advisory: Red Hat Quay 3.15.6",
"tracking": {
"current_release_date": "2026-08-12T04:29:01+00:00",
"generator": {
"date": "2026-08-12T04:29:01+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.14"
}
},
"id": "RHSA-2026:42796",
"initial_release_date": "2026-07-21T13:53:09+00:00",
"revision_history": [
{
"date": "2026-07-21T13:53:09+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-08-08T04:36:23+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-12T04:29:01+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Quay 3.15",
"product": {
"name": "Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:quay:3.15::el8"
}
}
}
],
"category": "product_family",
"name": "Red Hat Quay"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"product_id": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-bundle@sha256%3Ab42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-bundle\u0026tag=1784352323"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"product_id": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-rhel8@sha256%3A934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel8\u0026tag=1784351626"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"product_id": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-bundle@sha256%3A4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-bundle\u0026tag=1784352589"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"product_id": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-rhel8@sha256%3Ae328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel8\u0026tag=1784351655"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"product_id": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-qemu-rhcos-rhel8@sha256%3A46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8\u0026tag=1784352052"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"product_id": "registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-rhel8@sha256%3A71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel8\u0026tag=1784351680"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"product": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"product_id": "registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"product_identification_helper": {
"purl": "pkg:oci/clair-rhel8@sha256%3Abdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c?arch=amd64\u0026repository_url=registry.redhat.io/quay/clair-rhel8\u0026tag=1784351652"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"product_id": "registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-bundle@sha256%3Aab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-operator-bundle\u0026tag=1784356254"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"product_id": "registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-rhel8@sha256%3A5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-operator-rhel8\u0026tag=1784351641"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"product": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"product_id": "registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"product_identification_helper": {
"purl": "pkg:oci/quay-rhel8@sha256%3A55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-rhel8\u0026tag=1784351966"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"product": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"product_id": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-rhel8@sha256%3Af6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel8\u0026tag=1784351626"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"product": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"product_id": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-rhel8@sha256%3Ace5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel8\u0026tag=1784351655"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"product": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"product_id": "registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-rhel8@sha256%3A77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel8\u0026tag=1784351680"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"product": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"product_id": "registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/clair-rhel8@sha256%3A8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/clair-rhel8\u0026tag=1784351652"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"product": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"product_id": "registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-rhel8@sha256%3Aefcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-operator-rhel8\u0026tag=1784351641"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le",
"product": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le",
"product_id": "registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/quay-rhel8@sha256%3A6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46?arch=ppc64le\u0026repository_url=registry.redhat.io/quay/quay-rhel8\u0026tag=1784351966"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"product": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"product_id": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-container-security-operator-rhel8@sha256%3A93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel8\u0026tag=1784351626"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"product": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"product_id": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-bridge-operator-rhel8@sha256%3A025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel8\u0026tag=1784351655"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"product": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"product_id": "registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-builder-rhel8@sha256%3A5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel8\u0026tag=1784351680"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"product": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"product_id": "registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"product_identification_helper": {
"purl": "pkg:oci/clair-rhel8@sha256%3A15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4?arch=s390x\u0026repository_url=registry.redhat.io/quay/clair-rhel8\u0026tag=1784351652"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"product": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"product_id": "registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-operator-rhel8@sha256%3A7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-operator-rhel8\u0026tag=1784351641"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"product": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"product_id": "registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"product_identification_helper": {
"purl": "pkg:oci/quay-rhel8@sha256%3A3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1?arch=s390x\u0026repository_url=registry.redhat.io/quay/quay-rhel8\u0026tag=1784351966"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x"
},
"product_reference": "registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le"
},
"product_reference": "registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64 as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64"
},
"product_reference": "registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64 as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x"
},
"product_reference": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le"
},
"product_reference": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64 as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64 as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x"
},
"product_reference": "registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64 as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le"
},
"product_reference": "registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64 as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x"
},
"product_reference": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64 as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le"
},
"product_reference": "registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64 as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64 as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x"
},
"product_reference": "registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
},
"product_reference": "registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x"
},
"product_reference": "registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64 as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64"
},
"product_reference": "registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"relates_to_product_reference": "Red Hat Quay 3.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le as a component of Red Hat Quay 3.15",
"product_id": "Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
},
"product_reference": "registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le",
"relates_to_product_reference": "Red Hat Quay 3.15"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-9277",
"cwe": {
"id": "CWE-78",
"name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
},
"discovery_date": "2026-05-22T14:01:14.427751+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480741"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the shell-quote component. The quote() function did not properly validate object-token inputs, allowing line terminators to pass unescaped into the output. A remote attacker could exploit this vulnerability by providing specially crafted input, which a POSIX shell would interpret as a command separator. This could lead to command injection, enabling the attacker to execute arbitrary code on the system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "shell-quote: shell-quote: Arbitrary code execution via command injection due to unescaped line terminators",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-9277"
},
{
"category": "external",
"summary": "RHBZ#2480741",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480741"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-9277",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-9277"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-9277",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9277"
},
{
"category": "external",
"summary": "https://github.com/ljharb/shell-quote",
"url": "https://github.com/ljharb/shell-quote"
},
{
"category": "external",
"summary": "https://github.com/ljharb/shell-quote/commit/1518179",
"url": "https://github.com/ljharb/shell-quote/commit/1518179"
},
{
"category": "external",
"summary": "https://github.com/ljharb/shell-quote/security/advisories/GHSA-w7jw-789q-3m8p",
"url": "https://github.com/ljharb/shell-quote/security/advisories/GHSA-w7jw-789q-3m8p"
},
{
"category": "external",
"summary": "https://www.npmjs.com/package/shell-quote",
"url": "https://www.npmjs.com/package/shell-quote"
}
],
"release_date": "2026-05-22T13:22:38.873000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T13:53:09+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:42796"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "shell-quote: shell-quote: Arbitrary code execution via command injection due to unescaped line terminators"
},
{
"cve": "CVE-2026-10143",
"cwe": {
"id": "CWE-606",
"name": "Unchecked Input for Loop Condition"
},
"discovery_date": "2026-06-10T21:02:14.712750+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487722"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in kafka-python. A malicious or machine-in-the-middle broker could exploit a denial-of-service vulnerability during SCRAM authentication. By providing an excessively large iteration count, the broker can cause the client\u0027s event loop to freeze. This prevents critical operations such as sending messages, polling for new messages, and maintaining heartbeats, ultimately leading to consumer group eviction and persistent connection failures.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kafka-python: kafka-python: Denial of Service via excessive SCRAM authentication iteration count",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-10143"
},
{
"category": "external",
"summary": "RHBZ#2487722",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487722"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-10143",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-10143"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-10143",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10143"
},
{
"category": "external",
"summary": "https://github.com/dpkp/kafka-python/commit/6e4831444f972d169cdd11f5c8d50333cea3f19b",
"url": "https://github.com/dpkp/kafka-python/commit/6e4831444f972d169cdd11f5c8d50333cea3f19b"
},
{
"category": "external",
"summary": "https://github.com/dpkp/kafka-python/pull/3019",
"url": "https://github.com/dpkp/kafka-python/pull/3019"
},
{
"category": "external",
"summary": "https://github.com/dpkp/kafka-python/pull/3026",
"url": "https://github.com/dpkp/kafka-python/pull/3026"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/kafka-python-prior-to-dos-via-scram-iteration-count-in-scram-py",
"url": "https://www.vulncheck.com/advisories/kafka-python-prior-to-dos-via-scram-iteration-count-in-scram-py"
}
],
"release_date": "2026-06-10T20:22:39.262000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T13:53:09+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:42796"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "kafka-python: kafka-python: Denial of Service via excessive SCRAM authentication iteration count"
},
{
"cve": "CVE-2026-12143",
"cwe": {
"id": "CWE-93",
"name": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)"
},
"discovery_date": "2026-06-12T19:00:57.360953+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2488480"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in form-data, a library for creating readable multipart/form-data streams. A remote attacker can exploit this vulnerability by injecting carriage return (CR), line feed (LF), or double-quote (\") characters into the `field` argument of `FormData#append` or the `filename` option. This allows the attacker to inject additional headers or smuggle entire additional multipart parts into requests, potentially enabling them to add or override form fields and compromise data integrity.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "form-data: form-data: Form field override via CRLF injection",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important impact flaw in the form-data library: a remote attacker can inject arbitrary headers or additional multipart parts via CRLF injection in field names or filenames, potentially overriding sensitive form fields and affecting data integrity.\n\nFor RHOAI and RHEL AI, severity is Moderate because affected versions appear only as a transitive npm dependency in RHOAI (dashboard, mod-arch plugins, MLflow UI) and RHEL AI 3.4 bootc images, and those products use fixed field names for uploads rather than passing untrusted user input as multipart field names or filenames. The documented exploit path is therefore not reachable in default deployments. Practical impact is limited to non-default or custom integrations that forward multipart requests using attacker-controlled field names.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-12143"
},
{
"category": "external",
"summary": "RHBZ#2488480",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488480"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-12143",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-12143"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-12143",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12143"
},
{
"category": "external",
"summary": "https://cwe.mitre.org/data/definitions/93.html",
"url": "https://cwe.mitre.org/data/definitions/93.html"
},
{
"category": "external",
"summary": "https://github.com/form-data/form-data/commit/64190db548c0179e37206858e39f27cf513e9435",
"url": "https://github.com/form-data/form-data/commit/64190db548c0179e37206858e39f27cf513e9435"
},
{
"category": "external",
"summary": "https://github.com/form-data/form-data/commit/be3f3cf553978bac15a5182f1f3c3d2d38ccf229",
"url": "https://github.com/form-data/form-data/commit/be3f3cf553978bac15a5182f1f3c3d2d38ccf229"
},
{
"category": "external",
"summary": "https://github.com/form-data/form-data/commit/c7133499c2ee1b80c678e411244f4442bf902045",
"url": "https://github.com/form-data/form-data/commit/c7133499c2ee1b80c678e411244f4442bf902045"
},
{
"category": "external",
"summary": "https://github.com/form-data/form-data/security/advisories/GHSA-hmw2-7cc7-3qxx",
"url": "https://github.com/form-data/form-data/security/advisories/GHSA-hmw2-7cc7-3qxx"
},
{
"category": "external",
"summary": "https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#multipart-form-data",
"url": "https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#multipart-form-data"
},
{
"category": "external",
"summary": "https://www.npmjs.com/package/form-data",
"url": "https://www.npmjs.com/package/form-data"
}
],
"release_date": "2026-06-12T18:01:30.362000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T13:53:09+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:42796"
},
{
"category": "workaround",
"details": "Applications using the `form-data` library should implement strict input validation and sanitization for all field names and filenames derived from untrusted sources. This prevents the injection of control characters (CR, LF, \") that could lead to header injection or form field overrides. Deployments that exclusively use fixed or trusted field names are not impacted.",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "form-data: form-data: Form field override via CRLF injection"
},
{
"acknowledgments": [
{
"names": [
"Antony Di Scala",
"Michael Whale"
]
}
],
"cve": "CVE-2026-32591",
"cwe": {
"id": "CWE-918",
"name": "Server-Side Request Forgery (SSRF)"
},
"discovery_date": "2026-03-12T15:09:38.210000+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2446965"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Red Hat Quay\u0027s Proxy Cache configuration feature. When an organization administrator configures an upstream registry for proxy caching, Quay makes a network connection to the specified registry hostname without verifying that it points to a legitimate external service. An attacker with organization administrator privileges could supply a crafted hostname to force the Quay server to make requests to internal network services, cloud infrastructure endpoints, or other resources that should not be accessible from the Quay application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "mirror-registry: quay: server-side request forgery in proxy cache upstream registry configuration",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Exploitation requires the attacker to be authenticated as an organization administrator.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32591"
},
{
"category": "external",
"summary": "RHBZ#2446965",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2446965"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32591",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32591"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32591",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32591"
}
],
"release_date": "2026-04-08T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T13:53:09+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:42796"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "mirror-registry: quay: server-side request forgery in proxy cache upstream registry configuration"
},
{
"cve": "CVE-2026-39820",
"cwe": {
"id": "CWE-606",
"name": "Unchecked Input for Loop Condition"
},
"discovery_date": "2026-05-07T20:01:27.800929+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467820"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `net/mail` package of the Go programming language. An attacker could provide specially crafted inputs to the `ParseAddress`, `ParseAddressList`, or `ParseDate` functions. This could lead to excessive consumption of CPU and memory resources, resulting in a Denial of Service (DoS) for applications processing these inputs.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/mail: golang: Go net/mail: Denial of Service via crafted email inputs",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in the Go `net/mail` package. Applications processing untrusted email inputs via `ParseAddress`, `ParseAddressList`, or `ParseDate` functions are susceptible to excessive resource consumption, which can lead to service unavailability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39820"
},
{
"category": "external",
"summary": "RHBZ#2467820",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467820"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39820",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39820"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39820",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39820"
},
{
"category": "external",
"summary": "https://go.dev/cl/759940",
"url": "https://go.dev/cl/759940"
},
{
"category": "external",
"summary": "https://go.dev/issue/78566",
"url": "https://go.dev/issue/78566"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
"url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4986",
"url": "https://pkg.go.dev/vuln/GO-2026-4986"
}
],
"release_date": "2026-05-07T19:41:19.854000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T13:53:09+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:42796"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net/mail: golang: Go net/mail: Denial of Service via crafted email inputs"
},
{
"cve": "CVE-2026-39821",
"cwe": {
"id": "CWE-1289",
"name": "Improper Validation of Unsafe Equivalence in Input"
},
"discovery_date": "2026-05-22T16:00:52.844126+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480756"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname (for example, xn--example-.com returns example.com instead of an error). Applications that validate the ASCII form then convert to Unicode may grant access to a restricted hostname the ASCII check would have rejected.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "golang.org/x/net/idna is vulnerable to privilege escalation through incorrect Punycode label handling in ToASCII and ToUnicode. An attacker who can supply a Punycode hostname that passes an ASCII-only authorization check may have it normalized to a restricted ASCII name the application intended to block. Red Hat exposure is broad across products shipping the Go toolchain or bundling golang.org/x/net, including RHEL and RHEL-AI golang RPMs, hummingbird Go runtimes, OpenShift and ODF container builds, and Ceph/OpenShift components compiled against affected x/net versions.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39821"
},
{
"category": "external",
"summary": "RHBZ#2480756",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480756"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39821",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39821"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39821",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39821"
},
{
"category": "external",
"summary": "https://go.dev/cl/767220",
"url": "https://go.dev/cl/767220"
},
{
"category": "external",
"summary": "https://go.dev/issue/78760",
"url": "https://go.dev/issue/78760"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8",
"url": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5026",
"url": "https://pkg.go.dev/vuln/GO-2026-5026"
}
],
"release_date": "2026-05-22T15:01:21.462000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T13:53:09+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:42796"
},
{
"category": "workaround",
"details": "Upgrade to a fixed golang.org/x/net release that includes the idna correction, via updated golang or dependent package rebuilds.",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing"
},
{
"cve": "CVE-2026-39828",
"cwe": {
"id": "CWE-281",
"name": "Improper Preservation of Permissions"
},
"discovery_date": "2026-05-22T04:01:46.775641+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480687"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh. A remote attacker could exploit this vulnerability when an SSH server authentication callback returned a PartialSuccessError with non-nil permissions. This flaw caused these permissions to be silently discarded, potentially bypassing certificate restrictions, such as a force-command, after a second authentication factor succeeded. This could lead to unauthorized command execution or access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important security flaw in the `golang.org/x/crypto/ssh` library. When an SSH server utilizing this library is configured with specific authentication callbacks that return a `PartialSuccessError` with non-nil permissions, an attacker could bypass intended certificate restrictions, such as `force-command`. This bypass could lead to unauthorized command execution or access on affected Red Hat systems configured with multi-factor authentication and certificate-based access controls.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39828"
},
{
"category": "external",
"summary": "RHBZ#2480687",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480687"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39828",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39828"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39828",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39828"
},
{
"category": "external",
"summary": "https://go.dev/cl/781621",
"url": "https://go.dev/cl/781621"
},
{
"category": "external",
"summary": "https://go.dev/issue/79562",
"url": "https://go.dev/issue/79562"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5014",
"url": "https://pkg.go.dev/vuln/GO-2026-5014"
}
],
"release_date": "2026-05-22T02:31:26.883000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T13:53:09+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:42796"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions"
},
{
"cve": "CVE-2026-39829",
"cwe": {
"id": "CWE-1284",
"name": "Improper Validation of Specified Quantity in Input"
},
"discovery_date": "2026-05-22T04:01:30.092249+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480681"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh. The RSA and DSA public key parsers in the affected component did not enforce size limits on key parameters. This vulnerability allows an unauthenticated client to provide a crafted public key with an excessively large modulus or DSA parameter during public key authentication. Successful exploitation could lead to a denial of service (DoS) due to prolonged CPU consumption during signature verification.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability in golang.org/x/crypto/ssh is rated as Important. An unauthenticated remote attacker could trigger a denial of service by providing a specially crafted public key with excessively large parameters during SSH public key authentication. This could lead to prolonged CPU consumption on the server, impacting service availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39829"
},
{
"category": "external",
"summary": "RHBZ#2480681",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480681"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39829",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39829"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39829",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39829"
},
{
"category": "external",
"summary": "https://go.dev/cl/781641",
"url": "https://go.dev/cl/781641"
},
{
"category": "external",
"summary": "https://go.dev/cl/781661",
"url": "https://go.dev/cl/781661"
},
{
"category": "external",
"summary": "https://go.dev/issue/79565",
"url": "https://go.dev/issue/79565"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5018",
"url": "https://pkg.go.dev/vuln/GO-2026-5018"
}
],
"release_date": "2026-05-22T02:31:27.324000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T13:53:09+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:42796"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters"
},
{
"cve": "CVE-2026-39830",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-05-22T04:01:38.517202+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480684"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh. A remote malicious SSH peer can exploit this by sending unsolicited global request responses, which fills an internal buffer and blocks the connection\u0027s read loop. This prevents the associated resources from being released, leading to a resource leak per connection. The consequence is a Denial of Service (DoS) for the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service flaw in `golang.org/x/crypto/ssh`. A remote, unauthenticated attacker can exploit this vulnerability by sending unsolicited global request responses to an affected SSH server, leading to resource exhaustion and a denial of service. The impact is considered Important due to the potential for unauthenticated remote disruption of services utilizing the vulnerable SSH library.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39830"
},
{
"category": "external",
"summary": "RHBZ#2480684",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480684"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39830",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39830"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39830",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39830"
},
{
"category": "external",
"summary": "https://go.dev/cl/781640",
"url": "https://go.dev/cl/781640"
},
{
"category": "external",
"summary": "https://go.dev/cl/781664",
"url": "https://go.dev/cl/781664"
},
{
"category": "external",
"summary": "https://go.dev/issue/79564",
"url": "https://go.dev/issue/79564"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5017",
"url": "https://pkg.go.dev/vuln/GO-2026-5017"
}
],
"release_date": "2026-05-22T02:31:27.208000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T13:53:09+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:42796"
},
{
"category": "workaround",
"details": "To mitigate this denial of service vulnerability, restrict network access to any service that utilizes the `golang.org/x/crypto/ssh` library and is exposed to untrusted networks. Implement firewall rules to allow connections only from trusted hosts or networks. This action limits the ability of malicious peers to send unsolicited global request responses. A restart of the affected service may be necessary for the new network rules to be applied effectively.",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses"
},
{
"cve": "CVE-2026-39831",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-05-22T04:01:12.861178+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480675"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh. The Verify() method, responsible for FIDO/U2F security key types, did not properly check for user presence. This allowed signatures to be accepted without requiring a physical touch on the hardware security key. As a result, an attacker could potentially use a hardware security key in an unattended manner, bypassing a critical security control designed to ensure user intent.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39831"
},
{
"category": "external",
"summary": "RHBZ#2480675",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480675"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39831",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39831"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39831",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39831"
},
{
"category": "external",
"summary": "https://go.dev/cl/781662",
"url": "https://go.dev/cl/781662"
},
{
"category": "external",
"summary": "https://go.dev/issue/79566",
"url": "https://go.dev/issue/79566"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5019",
"url": "https://pkg.go.dev/vuln/GO-2026-5019"
}
],
"release_date": "2026-05-22T02:31:27.436000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T13:53:09+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:42796"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check"
},
{
"cve": "CVE-2026-39832",
"cwe": {
"id": "CWE-281",
"name": "Improper Preservation of Permissions"
},
"discovery_date": "2026-05-22T04:01:41.402561+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480685"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh/agent. When a key was added to a remote agent, security restrictions, known as constraint extensions, were not properly processed during the request. This allowed these restrictions to be silently removed when keys were forwarded, leading to the unrestricted use of the key on the remote host. This vulnerability could enable an attacker to bypass intended security controls and perform unauthorized actions.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important vulnerability in `golang.org/x/crypto/ssh/agent` allows for a security bypass when SSH keys with destination restrictions are forwarded via an SSH agent. This flaw could lead to unintended exposure of SSH keys, enabling an attacker to use the forwarded key without the specified restrictions on remote hosts. Red Hat products utilizing `golang.org/x/crypto/ssh/agent` for key forwarding may be affected if users rely on constraint extensions for limiting key usage.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39832"
},
{
"category": "external",
"summary": "RHBZ#2480685",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480685"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39832",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39832"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39832",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39832"
},
{
"category": "external",
"summary": "https://go.dev/cl/778642",
"url": "https://go.dev/cl/778642"
},
{
"category": "external",
"summary": "https://go.dev/issue/79435",
"url": "https://go.dev/issue/79435"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5006",
"url": "https://pkg.go.dev/vuln/GO-2026-5006"
}
],
"release_date": "2026-05-22T02:31:26.660000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T13:53:09+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:42796"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions"
},
{
"cve": "CVE-2026-39835",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"discovery_date": "2026-05-22T04:01:27.279943+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480680"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh. SSH servers configured to use CertChecker as a public key callback, without explicitly setting IsUserAuthority or IsHostAuthority, are vulnerable. A remote attacker can exploit this by presenting a specially crafted certificate, causing the server to panic and resulting in a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service flaw in `golang.org/x/crypto/ssh` affecting SSH servers that utilize `CertChecker` as a public key callback without explicitly configuring `IsUserAuthority` or `IsHostAuthority`. A remote, unauthenticated attacker can trigger a server panic by presenting a specially crafted certificate, leading to service disruption. Exploitation requires a specific, non-default configuration of the `CertChecker`.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39835"
},
{
"category": "external",
"summary": "RHBZ#2480680",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480680"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39835",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39835"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39835",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39835"
},
{
"category": "external",
"summary": "https://go.dev/cl/781660",
"url": "https://go.dev/cl/781660"
},
{
"category": "external",
"summary": "https://go.dev/issue/79563",
"url": "https://go.dev/issue/79563"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5015",
"url": "https://pkg.go.dev/vuln/GO-2026-5015"
}
],
"release_date": "2026-05-22T02:31:26.982000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T13:53:09+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:42796"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate"
},
{
"cve": "CVE-2026-42151",
"cwe": {
"id": "CWE-256",
"name": "Plaintext Storage of a Password"
},
"discovery_date": "2026-05-04T19:02:26.983660+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2466507"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Prometheus, an open-source monitoring system. The `client_secret` field within the Azure Active Directory (AD) remote write OAuth configuration was incorrectly handled as a plain string instead of a secure Secret type. This misconfiguration allowed any user or process with access to the `/-/config` HTTP API endpoint to view the Azure OAuth client secret in plaintext. This vulnerability leads to information disclosure, potentially compromising the security of integrated Azure AD services.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important information disclosure flaw in Prometheus affects instances configured to use Azure AD remote write with OAuth authentication. The client secret, intended to be a secure credential, is exposed in plaintext through the `/-/config` HTTP API endpoint. This could allow an attacker with access to this endpoint to retrieve the secret, potentially compromising integrated Azure AD services.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42151"
},
{
"category": "external",
"summary": "RHBZ#2466507",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466507"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42151",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42151"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42151",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42151"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/pull/18587",
"url": "https://github.com/prometheus/prometheus/pull/18587"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/pull/18590",
"url": "https://github.com/prometheus/prometheus/pull/18590"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/releases/tag/v3.11.3",
"url": "https://github.com/prometheus/prometheus/releases/tag/v3.11.3"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/releases/tag/v3.5.3",
"url": "https://github.com/prometheus/prometheus/releases/tag/v3.5.3"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/security/advisories/GHSA-wg65-39gg-5wfj",
"url": "https://github.com/prometheus/prometheus/security/advisories/GHSA-wg65-39gg-5wfj"
}
],
"release_date": "2026-05-04T18:12:16.917000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T13:53:09+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:42796"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API"
},
{
"cve": "CVE-2026-42154",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-05-04T19:02:19.626646+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2466505"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Prometheus. An unauthenticated attacker can exploit the remote read endpoint (`/api/v1/read`) by sending a specially crafted, small snappy-compressed payload. This payload causes a disproportionately large memory allocation, leading to memory exhaustion and a Denial of Service (DoS) by crashing the Prometheus process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in Prometheus, allowing an unauthenticated remote attacker to crash the Prometheus process. This could lead to service unavailability in Red Hat products that deploy Prometheus for monitoring, as the remote read endpoint does not properly validate snappy-compressed request lengths.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42154"
},
{
"category": "external",
"summary": "RHBZ#2466505",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466505"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42154",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42154"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42154",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42154"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/pull/18584",
"url": "https://github.com/prometheus/prometheus/pull/18584"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/pull/18585",
"url": "https://github.com/prometheus/prometheus/pull/18585"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/releases/tag/v3.11.3",
"url": "https://github.com/prometheus/prometheus/releases/tag/v3.11.3"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/releases/tag/v3.5.3",
"url": "https://github.com/prometheus/prometheus/releases/tag/v3.5.3"
},
{
"category": "external",
"summary": "https://github.com/prometheus/prometheus/security/advisories/GHSA-8rm2-7qqf-34qm",
"url": "https://github.com/prometheus/prometheus/security/advisories/GHSA-8rm2-7qqf-34qm"
}
],
"release_date": "2026-05-04T18:13:12.340000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T13:53:09+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:42796"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint"
},
{
"cve": "CVE-2026-42499",
"cwe": {
"id": "CWE-1046",
"name": "Creation of Immutable Text Using String Concatenation"
},
"discovery_date": "2026-05-07T20:00:51.685602+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467809"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `net/mail` package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the `consumePhrase` function, it can lead to excessive resource consumption due to quadratic string concatenation, resulting in a Denial of Service (DoS) condition.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/mail: golang: net/mail: Denial of Service via pathological email address parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in the `net/mail` package of the Go standard library. A remote attacker can exploit this flaw by sending specially crafted email addresses, leading to excessive resource consumption and a denial of service in Go applications that parse email addresses using the affected library.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42499"
},
{
"category": "external",
"summary": "RHBZ#2467809",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467809"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42499",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42499"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42499",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42499"
},
{
"category": "external",
"summary": "https://go.dev/cl/771520",
"url": "https://go.dev/cl/771520"
},
{
"category": "external",
"summary": "https://go.dev/issue/78987",
"url": "https://go.dev/issue/78987"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
"url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4977",
"url": "https://pkg.go.dev/vuln/GO-2026-4977"
}
],
"release_date": "2026-05-07T19:41:18.615000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T13:53:09+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:42796"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net/mail: golang: net/mail: Denial of Service via pathological email address parsing"
},
{
"cve": "CVE-2026-42508",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-05-22T04:01:49.515058+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480688"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh/knownhosts. This vulnerability occurs because the system did not correctly check for the revocation status of a SignatureKey belonging to a Certificate Authority (CA). A remote attacker could potentially exploit this by presenting a revoked key, leading to the system accepting it as valid. This could allow an attacker to bypass security checks and potentially gain unauthorized access or spoof legitimate entities.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: A flaw in `golang.org/x/crypto/ssh/knownhosts` allows a remote attacker to bypass security checks. This vulnerability arises because the system fails to properly verify the revocation status of a Certificate Authority (CA) `SignatureKey`. In Red Hat environments, this could enable an attacker to present a revoked key, leading to its acceptance as valid and potentially granting unauthorized access or facilitating the spoofing of legitimate entities.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42508"
},
{
"category": "external",
"summary": "RHBZ#2480688",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480688"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42508",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42508"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42508",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42508"
},
{
"category": "external",
"summary": "https://go.dev/cl/781220",
"url": "https://go.dev/cl/781220"
},
{
"category": "external",
"summary": "https://go.dev/issue/79568",
"url": "https://go.dev/issue/79568"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5021",
"url": "https://pkg.go.dev/vuln/GO-2026-5021"
}
],
"release_date": "2026-05-22T02:31:27.644000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T13:53:09+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:42796"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey"
},
{
"cve": "CVE-2026-44432",
"cwe": {
"id": "CWE-409",
"name": "Improper Handling of Highly Compressed Data (Data Amplification)"
},
"discovery_date": "2026-05-13T17:01:01.083841+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477154"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in urllib3, an HTTP client library for Python. This vulnerability allows a remote attacker to cause excessive resource consumption, such as high CPU usage and massive memory allocation, on the client side. This occurs when urllib3 attempts to decompress an entire HTTP response, even if only a partial read was requested, or when draining the connection after a partial decompression. This can lead to a Denial of Service (DoS) condition.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44432"
},
{
"category": "external",
"summary": "RHBZ#2477154",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477154"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44432",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44432"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44432",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44432"
},
{
"category": "external",
"summary": "https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j",
"url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j"
}
],
"release_date": "2026-05-13T15:17:12.611000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T13:53:09+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:42796"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression"
},
{
"cve": "CVE-2026-44486",
"cwe": {
"id": "CWE-201",
"name": "Insertion of Sensitive Information Into Sent Data"
},
"discovery_date": "2026-06-11T17:01:30.944384+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487947"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios, a promise-based HTTP client, specifically in its Node.js HTTP adapter. When Axios is configured to use an authenticated proxy and follows a redirect, it may inadvertently send the Proxy-Authorization header, containing proxy credentials, to the redirect target. This can lead to the disclosure of sensitive proxy credentials to an unintended remote server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: Information disclosure of proxy credentials via HTTP redirects",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important information disclosure flaw in the Axios Node.js HTTP adapter. Red Hat products utilizing Axios in a Node.js environment with an authenticated proxy and automatic redirects enabled are susceptible. The vulnerability arises when a request, initially sent through an authenticated proxy, is redirected to a target that no longer uses the proxy, potentially leaking `Proxy-Authorization` headers containing sensitive credentials to an untrusted remote server. This risk is heightened in deployments where applications interact with untrusted HTTP origins.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44486"
},
{
"category": "external",
"summary": "RHBZ#2487947",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487947"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44486",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44486"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44486",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44486"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-j5f8-grm9-p9fc",
"url": "https://github.com/axios/axios/security/advisories/GHSA-j5f8-grm9-p9fc"
}
],
"release_date": "2026-06-11T15:39:07.714000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T13:53:09+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:42796"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Axios: Information disclosure of proxy credentials via HTTP redirects"
},
{
"cve": "CVE-2026-44487",
"cwe": {
"id": "CWE-201",
"name": "Insertion of Sensitive Information Into Sent Data"
},
"discovery_date": "2026-06-11T17:01:34.091476+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487948"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios. During specific proxy-to-direct redirect flows in the Node.js HTTP adapter, a remote attacker could exploit this vulnerability. The Proxy-Authorization header, which contains proxy credentials and is intended only for the outbound proxy, may be forwarded to the final redirected origin. This can lead to the disclosure of sensitive proxy credentials to an unintended third party.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: Information disclosure of proxy credentials via redirect flows",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important information disclosure flaw in Axios affecting Node.js environments. When an application uses Axios with an authenticated HTTP proxy and follows redirects from an HTTP to a non-proxied HTTPS destination, the Proxy-Authorization header may be inadvertently sent to the final origin server. This could lead to the exposure of sensitive proxy credentials to an unintended third party.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44487"
},
{
"category": "external",
"summary": "RHBZ#2487948",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487948"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44487",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44487"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44487",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44487"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-p92q-9vqr-4j8v",
"url": "https://github.com/axios/axios/security/advisories/GHSA-p92q-9vqr-4j8v"
}
],
"release_date": "2026-06-11T15:38:25.150000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T13:53:09+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:42796"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Axios: Information disclosure of proxy credentials via redirect flows"
},
{
"cve": "CVE-2026-44488",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-06-11T17:01:36.836488+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487949"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios, a promise-based HTTP client. When using the fetch adapter, Axios did not properly enforce configured request and response size limits. This vulnerability allows a remote attacker, through a malicious or compromised server, or by supplying a large data URL, to send or receive oversized data bodies. This can lead to resource exhaustion in server-side applications, resulting in a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: Denial of Service due to unenforced request and response size limits",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: A denial of service flaw was found in Axios, a JavaScript HTTP client library. This issue arises when applications utilize the `fetch` adapter, as configured request and response size limits are not properly enforced. A remote attacker could exploit this by sending or receiving excessively large data bodies, leading to resource exhaustion and potential denial of service in affected server-side applications.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44488"
},
{
"category": "external",
"summary": "RHBZ#2487949",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487949"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44488",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44488"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44488",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44488"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-777c-7fjr-54vf",
"url": "https://github.com/axios/axios/security/advisories/GHSA-777c-7fjr-54vf"
}
],
"release_date": "2026-06-11T15:37:38.013000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T13:53:09+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:42796"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Axios: Denial of Service due to unenforced request and response size limits"
},
{
"cve": "CVE-2026-44492",
"cwe": {
"id": "CWE-289",
"name": "Authentication Bypass by Alternate Name"
},
"discovery_date": "2026-06-11T17:00:56.761751+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487938"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios, a promise-based HTTP client. This vulnerability occurs because Axios does not properly normalize IPv4-mapped IPv6 addresses. When a NO_PROXY setting is configured to block direct access to specific IPv4 addresses, an attacker can bypass this restriction by using the IPv4-mapped IPv6 form of the address in a request URL. This allows the request to be routed through the proxy, potentially exposing internal services or sensitive information that should otherwise be inaccessible.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: Proxy bypass via IPv4-mapped IPv6 address non-normalization",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in Axios, a JavaScript HTTP client library, that allows for a proxy bypass. When a `NO_PROXY` environment variable is configured to prevent direct connections to specific IPv4 addresses, an attacker can craft a request URL using the IPv4-mapped IPv6 address format. This bypasses the intended `NO_PROXY` exclusion, routing the request through the configured proxy and potentially exposing internal services or sensitive information, such as cloud instance metadata credentials.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44492"
},
{
"category": "external",
"summary": "RHBZ#2487938",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487938"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44492",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44492"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44492",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44492"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-pjwm-pj3p-43mv",
"url": "https://github.com/axios/axios/security/advisories/GHSA-pjwm-pj3p-43mv"
}
],
"release_date": "2026-06-11T15:29:13.890000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T13:53:09+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:42796"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Axios: Proxy bypass via IPv4-mapped IPv6 address non-normalization"
},
{
"cve": "CVE-2026-44494",
"cwe": {
"id": "CWE-915",
"name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
},
"discovery_date": "2026-06-11T17:01:12.945664+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487942"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios. This vulnerability, a Prototype Pollution \"Gadget\" attack, allows an attacker to escalate any existing Object.prototype pollution in an application\u0027s dependency tree into a full Man-in-the-Middle (MITM) attack. This enables the attacker to intercept, read, and modify all HTTP traffic, including sensitive authentication credentials. The flaw occurs because the `config.proxy` setting is susceptible to prototype pollution, allowing an attacker to inject a malicious proxy server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: Man-in-the-Middle (MITM) attack via Prototype Pollution",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in the Axios library allows an attacker to escalate existing prototype pollution vulnerabilities within an application\u0027s dependency tree into a full Man-in-the-Middle (MITM) attack. By injecting a malicious proxy configuration into the `Object.prototype`, an attacker can intercept, read, and modify all HTTP traffic, including sensitive authentication credentials, without direct user interaction. This poses a significant risk to data confidentiality and integrity in Red Hat products that utilize the Axios library.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44494"
},
{
"category": "external",
"summary": "RHBZ#2487942",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487942"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44494",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44494"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44494",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44494"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-35jp-ww65-95wh",
"url": "https://github.com/axios/axios/security/advisories/GHSA-35jp-ww65-95wh"
}
],
"release_date": "2026-06-11T15:32:03.155000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T13:53:09+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:42796"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Axios: Man-in-the-Middle (MITM) attack via Prototype Pollution"
},
{
"cve": "CVE-2026-44495",
"cwe": {
"id": "CWE-915",
"name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
},
"discovery_date": "2026-06-11T17:00:53.999811+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487937"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios, a promise-based HTTP client. This vulnerability involves prototype pollution gadgets in the request configuration processing. If another vulnerability has already polluted the Object.prototype.transformResponse, affected Axios versions may incorrectly interpret this inherited value as part of the request configuration or as an option validator. Axios does not itself create the prototype pollution. Exploitability requires a separate prototype-pollution vulnerability or equivalent attacker control over Object.prototype before Axios creates a request.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: Information disclosure due to prototype pollution vulnerability",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important vulnerability in Axios, a promise-based HTTP client, can lead to information disclosure, including credential theft and response hijacking, or denial of service. Exploitation requires a separate prototype pollution vulnerability in the same JavaScript process, allowing an attacker to control `Object.prototype.transformResponse`. Red Hat products using affected Axios versions are at risk if another component introduces such pollution.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44495"
},
{
"category": "external",
"summary": "RHBZ#2487937",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487937"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44495",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44495"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44495",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44495"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-3g43-6gmg-66jw",
"url": "https://github.com/axios/axios/security/advisories/GHSA-3g43-6gmg-66jw"
}
],
"release_date": "2026-06-11T15:33:12.433000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T13:53:09+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:42796"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Axios: Information disclosure due to prototype pollution vulnerability"
},
{
"cve": "CVE-2026-44496",
"cwe": {
"id": "CWE-1333",
"name": "Inefficient Regular Expression Complexity"
},
"discovery_date": "2026-06-11T17:01:15.856386+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487943"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Axios. A remote attacker, by influencing the XSRF cookie name in a browser environment, could cause the application to construct a regular expression that leads to excessive processing. This can result in a client-side Denial of Service (DoS), where the affected browser tab may freeze, impacting the availability of the application for the user.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "axios: Axios: Client-side Denial of Service via unescaped regex metacharacters in XSRF cookie name",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in Axios can lead to a client-side Denial of Service. An attacker capable of influencing the XSRF cookie name within a browser environment could trigger excessive regular expression processing, causing the affected browser tab to freeze and degrade user availability. This issue specifically impacts browser-based applications and does not affect Node.js HTTP adapter usage, React Native, or web workers.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44496"
},
{
"category": "external",
"summary": "RHBZ#2487943",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487943"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44496",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44496"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44496",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44496"
},
{
"category": "external",
"summary": "https://github.com/axios/axios/security/advisories/GHSA-hfxv-24rg-xrqf",
"url": "https://github.com/axios/axios/security/advisories/GHSA-hfxv-24rg-xrqf"
}
],
"release_date": "2026-06-11T15:34:28.492000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T13:53:09+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:42796"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "axios: Axios: Client-side Denial of Service via unescaped regex metacharacters in XSRF cookie name"
},
{
"cve": "CVE-2026-44990",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2026-06-12T21:02:24.911971+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2488565"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `sanitize-html` library. Under its default configuration, an attacker can embed malicious content within a disallowed `xmp` element. This vulnerability allows the attacker to bypass the HTML sanitization process, leading to stored Cross-Site Scripting (XSS). Successful exploitation can result in arbitrary code execution or information disclosure when a user views the affected content.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "sanitize-html: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw. The `sanitize-html` library, used in Red Hat products, is susceptible to a stored Cross-Site Scripting (XSS) bypass. Malicious content within a disallowed `xmp` element can be rendered as live HTML or JavaScript due to a sanitizer bypass in the default configuration. This can lead to arbitrary code execution or information disclosure when affected content is viewed.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44990"
},
{
"category": "external",
"summary": "RHBZ#2488565",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488565"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44990",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44990"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44990",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44990"
},
{
"category": "external",
"summary": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-rpr9-rxv7-x643",
"url": "https://github.com/apostrophecms/apostrophe/security/advisories/GHSA-rpr9-rxv7-x643"
}
],
"release_date": "2026-06-12T20:39:47.065000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T13:53:09+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:42796"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "sanitize-html: `sanitize-html`: Stored Cross-Site Scripting via HTML sanitizer bypass"
},
{
"cve": "CVE-2026-46595",
"cwe": {
"id": "CWE-303",
"name": "Incorrect Implementation of Authentication Algorithm"
},
"discovery_date": "2026-05-22T04:01:52.215134+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480689"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh. Source-address validation can be skipped when an SSH server configuration uses an authentication callback type other than public key, allowing authorization bypass in misconfigured servers. This is a follow-on to incomplete coverage from the CVE-2024-45337 fix.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "golang.org/x/crypto/ssh is vulnerable to authorization bypass when SSH server configurations rely on source-address validation alongside non-public-key authentication callbacks. An attacker with low privileges who can authenticate through such a callback path may bypass intended source-address restrictions and gain unauthorized SSH access. Red Hat impact sits in services built with affected x/crypto/ssh, including RHEL golang streams, hummingbird Go toolchains, RHACM/MCE agents, and OpenShift or Ceph components that embed Go SSH servers with mixed callback types.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-46595"
},
{
"category": "external",
"summary": "RHBZ#2480689",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480689"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-46595",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46595"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-46595",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46595"
},
{
"category": "external",
"summary": "https://go.dev/cl/781642",
"url": "https://go.dev/cl/781642"
},
{
"category": "external",
"summary": "https://go.dev/issue/79570",
"url": "https://go.dev/issue/79570"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5023",
"url": "https://pkg.go.dev/vuln/GO-2026-5023"
}
],
"release_date": "2026-05-22T02:31:27.894000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T13:53:09+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:42796"
},
{
"category": "workaround",
"details": "Upgrade to a fixed golang.org/x/crypto/ssh release via updated golang or package rebuilds. Ensure SSH servers use supported public-key callback configurations with source-address validation as intended.",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation"
},
{
"cve": "CVE-2026-46597",
"cwe": {
"id": "CWE-681",
"name": "Incorrect Conversion between Numeric Types"
},
"discovery_date": "2026-05-22T04:01:21.721980+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480678"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/crypto/ssh. A remote attacker could send specially crafted inputs to the AES-GCM packet decoder. This could lead to an incorrectly placed cast from bytes to an integer, causing a server-side panic and resulting in a Denial of Service (DoS) for the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important denial of service flaw in `golang.org/x/crypto/ssh` allows a remote attacker to trigger a server-side panic by sending specially crafted inputs to the AES-GCM packet decoder. This vulnerability could lead to service unavailability in Red Hat products that incorporate and expose SSH services built with the affected `golang.org/x/crypto/ssh` component.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-46597"
},
{
"category": "external",
"summary": "RHBZ#2480678",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480678"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-46597",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46597"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-46597",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46597"
},
{
"category": "external",
"summary": "https://go.dev/cl/781620",
"url": "https://go.dev/cl/781620"
},
{
"category": "external",
"summary": "https://go.dev/issue/79561",
"url": "https://go.dev/issue/79561"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI",
"url": "https://groups.google.com/g/golang-announce/c/a082jnz-LvI"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5013",
"url": "https://pkg.go.dev/vuln/GO-2026-5013"
}
],
"release_date": "2026-05-22T02:31:26.754000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T13:53:09+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:42796"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs"
},
{
"cve": "CVE-2026-48526",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-05-28T16:01:22.805235+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2482734"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PyJWT, a Python library for JSON Web Token (JWT) implementation. When decoding JWTs, the library fails to validate the use of JSON Web Keys (JWK) in the HMAC algorithm while also supporting asymmetric algorithms. This allows a remote attacker to use the issuer\u0027s public key as the secret key for the HMAC algorithm, leading to the ability to forge JWTs. This vulnerability can result in authentication bypass or unauthorized access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important vulnerability in PyJWT allows for authentication bypass and unauthorized access. It occurs when a JWT verifier is misconfigured to accept both symmetric and asymmetric algorithms, and a public JSON Web Key is erroneously used as the HMAC secret. Red Hat products are only affected if they utilize this specific, non-standard verifier configuration.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"known_not_affected": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-48526"
},
{
"category": "external",
"summary": "RHBZ#2482734",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482734"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-48526",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-48526"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48526",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48526"
},
{
"category": "external",
"summary": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx",
"url": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx"
}
],
"release_date": "2026-05-28T15:09:09.258000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T13:53:09+00:00",
"details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:42796"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:15683251d1fa746a06d2a00229341786e8c30abc3ea0524bce5bd0e9c63f35a4_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:8ef6aeb844ef1b27f6229e43eb40730cec60d1f526d591092ee8c87a1628a0f0_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/clair-rhel8@sha256:bdda83a73678d83ee2db6aeebb62ae958c510ddc6c9e2046b1eaf42a89d37f7c_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-bundle@sha256:4c927a525d6fd7d6aa6b373ff4396804c62a045aa118d556b0c6c9dfea41da82_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:025242f9cb11c9fda5f7b2aa4684e7a2c32a576bff585b2e44f72b6c92fe8bfd_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:ce5cb95162f088a8726780b2a7185030ee10cc5e24ae836d13be53d8180ec974_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-bridge-operator-rhel8@sha256:e328c7c06d260a6b926830c78ce72b527e1f414b6e7e339e8418997dce4ad3af_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8@sha256:46c0ebdf3f1992ae4a517f5d23e56e59c2dd86521c0304a3413b761ba6097041_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:5a920f1ee3582f2363e19252ba095b6890729409f8d46b6996901b6b3413f665_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:71930a5bb5582a0c09c3ccdb653b409178bf1f6b9bef69077c1ac3cfa990246d_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-builder-rhel8@sha256:77d5045a39f4004c8ba16ffd2b2c5afbfaab520958267fcaa79fa5683883f0a6_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-bundle@sha256:b42d71f71cddeee129d99c9eed21f4dc136a66b9a25f5254df3ed8102fbdd038_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:93132f0d217b876d04309a20f5db54028b85cb6f973e90991510f733d4d89d00_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:934518eecd9771a5daa7dcd32b4d7afb581f7f44664f8055a2515d6ca732b004_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-container-security-operator-rhel8@sha256:f6839afafbfd659412968f5482191d9e1042454e5131e0903060563899981581_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-bundle@sha256:ab26919a782fccd8e67b91775367c4296f6a47ca524a4246b49ed63b0aa14452_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:5a0f50cd11db2e119d2cbdfbe517a02cf2d3910585e49f1cd2ff996829ff9d33_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:7b33b511fc8fbfbaf9054ef7c76b1c9ba6575b8c876aaa4f3f4c6321aa3b8011_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-operator-rhel8@sha256:efcaaa625ebc59d50a89105069e1e51f5ec93a1090e0b151c98418b604fc3f7a_ppc64le",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:3dbea8c2d897f53fde0d1bfd29732b4353d706349a7b3df2953a6f47e5decfe1_s390x",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:55b4f383ce78ceddb4e979cc892daa9e9f325ea21926f4bdea95918bf6194d98_amd64",
"Red Hat Quay 3.15:registry.redhat.io/quay/quay-rhel8@sha256:6c72e83568757192c6b755ee4f8051104825e467b6343b096caf551b75dedd46_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens"
}
]
}
RHSA-2026:43038
Vulnerability from csaf_redhat - Published: 2026-07-21 22:10 - Updated: 2026-08-12 05:58Summary
Red Hat Security Advisory: Migration Toolkit for Applications
Severity
Critical
Notes
Topic: A new version of Migration Toolkit for Applications (MTA) is now available.
Details: Migration Toolkit for Applications (MTA) accelerates large-scale application modernization efforts across hybrid cloud environments on Red Hat OpenShift.
This solution provides insight throughout the adoption process, at both the portfolio and application levels: inventory, assess, analyze, and manage
applications for faster migration to OpenShift via the user interface.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in jupyter-server. This path traversal vulnerability exists due to insufficient validation of file paths, specifically an incorrect root directory boundary check and improper handling of directory traversal sequences. This allows a remote attacker with low privileges to bypass directory restrictions and gain unauthorized read and write access to files in sibling directories. This could lead to the exposure of sensitive data, particularly in shared hosting environments.
6.8 (Medium)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64 | — |
Vendor Fix
fix
|
Known not affected
25 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64 | — |
Threats
Impact
Moderate
A flaw was found in fast-uri. A remote attacker could exploit this vulnerability by crafting a malicious Uniform Resource Identifier (URI) that contains percent-encoded authority delimiters. The fast-uri library incorrectly decodes these delimiters during normalization and then re-emits them as raw separators, which can change the URI's intended authority. This issue allows applications that perform host allowlist checks, redirect validation, or outbound request routing to be steered to a different authority than specified, potentially bypassing security controls.
7.5 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64 | — |
Vendor Fix
fix
|
Known not affected
25 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64 | — |
Threats
Impact
Important
A flaw was found in fast-uri. This vulnerability occurs because fast-uri fails to properly convert Unicode (Internationalized Domain Name - IDN) hostnames for HTTP-family URLs. This can lead to a situation where security policies, such as denylists or redirect validations, are bypassed when applications use fast-uri to enforce these policies before passing the URL to another parser. A remote attacker could exploit this to circumvent security controls and potentially access unauthorized resources or perform malicious redirects.
7.5 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
25 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/net/html. A remote attacker could exploit this vulnerability by providing specially crafted HTML. When this arbitrary HTML is parsed and rendered, it can result in an unexpected HTML tree, bypassing input sanitization. This can be leveraged to execute Cross-Site Scripting (XSS) attacks, potentially leading to arbitrary code execution in applications that use the affected component.
8.1 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
25 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/net/html. When arbitrary HTML is parsed and then rendered, it can result in an unexpected HTML tree. This allows an attacker to bypass HTML sanitization mechanisms, leading to Cross-Site Scripting (XSS) attacks in applications. Such attacks can result in information disclosure or arbitrary code execution.
8.1 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
25 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in python-dotenv. A local attacker can exploit this by crafting a symbolic link, which the `set_key()` and `unset_key()` functions in python-dotenv follow when rewriting `.env` files. This can lead to the overwriting of arbitrary files on the system.
7.1 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
25 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64 | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in Mistune, a Markdown parser. This vulnerability, known as Regular Expression Denial of Service (ReDoS), exists in the `LINK_TITLE_RE` regular expression. A remote attacker can exploit this by providing specially crafted Markdown input, which causes the regular expression engine to engage in catastrophic backtracking. This leads to significant CPU consumption, making applications that use Mistune unresponsive and resulting in a Denial of Service.
7.5 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
25 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the `net` package of Go (golang), specifically when using the `LookupCNAME` function with the `cgo` DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name (CNAME) response. This can trigger a double-free of C memory, leading to a crash and a Denial of Service (DoS) for the affected application.
7.5 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
25 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework for asyncio and Python. An attacker could exploit this vulnerability by providing untrusted input to the `CookieJar.load()` function. This could potentially lead to arbitrary code execution, allowing the attacker to run malicious code on the affected system. This issue is most likely to occur in applications that allow attacker-controlled files to be loaded.
7.2 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
25 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jupyter Server. An authenticated user can exploit a path traversal vulnerability in the REST API to escape the configured root directory (`root_dir`). By crafting a request to the `/api/contents` endpoint with encoded path components, an attacker can gain access to sibling directories whose names begin with the same prefix as the `root_dir`. This allows the attacker to read, write, and delete files in these accessible sibling directories, potentially leading to unauthorized data access and modification, especially in multi-tenant environments.
7.1 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
25 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the `net/mail` package of the Go programming language. An attacker could provide specially crafted inputs to the `ParseAddress`, `ParseAddressList`, or `ParseDate` functions. This could lead to excessive consumption of CPU and memory resources, resulting in a Denial of Service (DoS) for applications processing these inputs.
7.5 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
25 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname (for example, xn--example-.com returns example.com instead of an error). Applications that validate the ASCII form then convert to Unicode may grant access to a restricted hostname the ASCII check would have rejected.
8.2 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
25 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jupyter Server. The Origin header validation, which uses Python's `re.match()` function, does not correctly validate incoming origins against allowed patterns. This allows a remote attacker to bypass Cross-Origin Resource Sharing (CORS) restrictions by crafting a malicious domain that partially matches a trusted one. Consequently, the attacker can make unauthorized cross-origin requests to the Jupyter Server API from an untrusted site, potentially leading to sensitive information disclosure or other unauthorized actions.
7.1 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
25 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Jupyter Notebook and JupyterLab. A stored cross-site scripting (XSS) vulnerability in the help command linker can be exploited by an attacker who crafts a malicious notebook file. When a user interacts with this file, the XSS is triggered, allowing the attacker to steal authentication tokens. Successful exploitation can lead to a complete takeover of the Jupyter session, enabling arbitrary code execution and information disclosure.
8.8 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
25 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in JupyterLab, an extensible environment for interactive computing. The PyPI Extension Manager, responsible for installing extensions, failed to properly enforce its allow-list of approved extensions. This vulnerability allowed for the installation of unauthorized extensions from sources outside the default PyPI index. Exploitation of this flaw could lead to arbitrary code execution and significant system compromise.
8.8 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
25 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the `net/mail` package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the `consumePhrase` function, it can lead to excessive resource consumption due to quadratic string concatenation, resulting in a Denial of Service (DoS) condition.
7.5 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
25 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the Golang MIME (Multipurpose Internet Mail Extensions) package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service (DoS) for the affected system.
7.5 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
25 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in jupyterlab. This vulnerability allows a remote attacker to achieve arbitrary code execution by presenting a user with a specially crafted notebook containing a deceptive button in its pre-saved HTML cell output. When the user clicks this button, the CommandLinker component executes arbitrary JupyterLab commands without sufficient validation, leading to the execution of unauthorized code.
8.8 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
25 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in python-multipart. A remote attacker can exploit this denial of service (DoS) vulnerability by sending a specially crafted request with an excessive number of part headers or a single very large header value during multipart/form-data parsing. This can lead to excessive CPU utilization, resulting in a denial of service for the affected system.
7.5 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64 | — |
Vendor Fix
fix
|
Known not affected
25 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64 | — |
Threats
Impact
Important
A flaw was found in urllib3, an HTTP client library for Python. When using the low-level API via `ProxyManager.connection_from_url().urlopen()` with `assert_same_host=False`, cross-origin redirects can still forward sensitive headers. This could allow a remote attacker to gain unauthorized access to sensitive information.
5.9 (Medium)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64 | — |
Vendor Fix
fix
|
Known not affected
25 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64 | — |
Threats
Impact
Moderate
A flaw was found in urllib3, an HTTP client library for Python. This vulnerability allows a remote attacker to cause excessive resource consumption, such as high CPU usage and massive memory allocation, on the client side. This occurs when urllib3 attempts to decompress an entire HTTP response, even if only a partial read was requested, or when draining the connection after a partial decompression. This can lead to a Denial of Service (DoS) condition.
7.5 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64 | — |
Vendor Fix
fix
|
Known not affected
25 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64 | — |
Threats
Impact
Important
A flaw was found in Jupyter Server. The nbconvert HTTP handlers in Jupyter Server render user-authored notebook HTML without a sandbox directive in their Content-Security-Policy. This, combined with nbconvert.HTMLExporter's default non-sanitizing behavior, allows a notebook containing an HTML payload to trigger a stored Cross-Site Scripting (XSS) vulnerability. A remote attacker could exploit this to gain cookie access, full API authority, and achieve kernel Remote Code Execution (RCE).
9.0 (Critical)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64 | — |
Vendor Fix
fix
|
Known not affected
25 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64 | — |
Threats
Impact
Important
A flaw was found in LangChain, a framework for building agents and large language model (LLM)-powered applications. Older runtime code paths within LangChain deserialize application-controlled payloads using overly broad object allowlists. A remote attacker can exploit this by supplying specially crafted LangChain serialized constructor dictionaries, leading to the instantiation of classes with untrusted arguments. This can result in the disclosure of sensitive information and potential partial compromise of data integrity.
8.2 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
25 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in OpenTelemetry Java, specifically within the baggage propagation implementation of opentelemetry-api and opentelemetry-extension-trace-propagators. A remote attacker can exploit this vulnerability by sending oversized baggage, which leads to unbounded memory allocation and high CPU consumption. This can result in a Denial of Service (DoS) for the affected service. Furthermore, because baggage is automatically re-injected into outgoing requests, the impact can spread to other downstream services.
7.5 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64 | — |
Vendor Fix
fix
|
Known not affected
25 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64 | — |
Threats
Impact
Important
A flaw was found in PyJWT, a Python library for JSON Web Token (JWT) implementation. When decoding JWTs, the library fails to validate the use of JSON Web Keys (JWK) in the HMAC algorithm while also supporting asymmetric algorithms. This allows a remote attacker to use the issuer's public key as the secret key for the HMAC algorithm, leading to the ability to forge JWTs. This vulnerability can result in authentication bypass or unauthorized access.
7.4 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64 | — |
Vendor Fix
fix
|
Known not affected
25 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64 | — | ||
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64 | — |
Threats
Impact
Important
A flaw was found in Starlette, a lightweight ASGI (Asynchronous Server Gateway Interface) framework. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP `Host` request header. This malformed header could cause the `request.url` to be incorrectly reconstructed, leading to a discrepancy with the actual requested path. Consequently, security restrictions enforced by middleware and endpoints that rely on `request.url` for validation could be bypassed, potentially allowing unauthorized access or actions.
6.5 (Medium)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
25 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64 | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in vLLM, an inference and serving engine for large language models (LLMs). This vulnerability, residing in ASGI web servers and Starlette's trust in them, allows an attacker to bypass the OpenAI API Authentication Middleware. This bypass enables unauthorized access to the API without requiring the configured VLLM_API_KEY or --api-key, leading to critical unauthorized operations.
9.1 (Critical)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
25 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in joserfc, a Python library for JSON Object Signing and Encryption (JOSE). This vulnerability allows a remote attacker to cause resource exhaustion, leading to a Denial of Service (DoS), by sending oversized JSON Web Signature (JWS) payloads. The library fails to apply size limits, specifically JWSRegistry.max_payload_length, when processing RFC7797 b64=false JWS payloads.
5.3 (Medium)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
25 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64 | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in Starlette where the request.form() method silently ignores configured resource limits (max_fields and max_part_size) when parsing application/x-www-form-urlencoded data. An unauthenticated attacker can exploit this by sending a urlencoded request body with an arbitrarily large number of fields or an oversized field, causing denial of service through resource exhaustion.
7.5 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
25 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in httplib2, a Python HTTP client library. This vulnerability allows a malicious or compromised HTTP server to send a small compressed data payload that, when decompressed by httplib2, expands to an extremely large size in memory. This unbounded decompression can lead to a Denial of Service (DoS) by causing the client application to run out of memory and crash.
7.5 (High)
Affected products
Fixed
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
25 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64 | — |
Workaround
|
Threats
Impact
Important
References
225 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Critical"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "A new version of Migration Toolkit for Applications (MTA) is now available.",
"title": "Topic"
},
{
"category": "general",
"text": "Migration Toolkit for Applications (MTA) accelerates large-scale application modernization efforts across hybrid cloud environments on Red Hat OpenShift. \nThis solution provides insight throughout the adoption process, at both the portfolio and application levels: inventory, assess, analyze, and manage\napplications for faster migration to OpenShift via the user interface.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:43038",
"url": "https://access.redhat.com/errata/RHSA-2026:43038"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-13676",
"url": "https://access.redhat.com/security/cve/CVE-2026-13676"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-25681",
"url": "https://access.redhat.com/security/cve/CVE-2026-25681"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-27136",
"url": "https://access.redhat.com/security/cve/CVE-2026-27136"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-28684",
"url": "https://access.redhat.com/security/cve/CVE-2026-28684"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33079",
"url": "https://access.redhat.com/security/cve/CVE-2026-33079"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33811",
"url": "https://access.redhat.com/security/cve/CVE-2026-33811"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-34993",
"url": "https://access.redhat.com/security/cve/CVE-2026-34993"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-35397",
"url": "https://access.redhat.com/security/cve/CVE-2026-35397"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39820",
"url": "https://access.redhat.com/security/cve/CVE-2026-39820"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-39821",
"url": "https://access.redhat.com/security/cve/CVE-2026-39821"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-40110",
"url": "https://access.redhat.com/security/cve/CVE-2026-40110"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-40171",
"url": "https://access.redhat.com/security/cve/CVE-2026-40171"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42266",
"url": "https://access.redhat.com/security/cve/CVE-2026-42266"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42499",
"url": "https://access.redhat.com/security/cve/CVE-2026-42499"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42504",
"url": "https://access.redhat.com/security/cve/CVE-2026-42504"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42557",
"url": "https://access.redhat.com/security/cve/CVE-2026-42557"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42561",
"url": "https://access.redhat.com/security/cve/CVE-2026-42561"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-44431",
"url": "https://access.redhat.com/security/cve/CVE-2026-44431"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-44432",
"url": "https://access.redhat.com/security/cve/CVE-2026-44432"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-44727",
"url": "https://access.redhat.com/security/cve/CVE-2026-44727"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-44843",
"url": "https://access.redhat.com/security/cve/CVE-2026-44843"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-45292",
"url": "https://access.redhat.com/security/cve/CVE-2026-45292"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-48526",
"url": "https://access.redhat.com/security/cve/CVE-2026-48526"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-48710",
"url": "https://access.redhat.com/security/cve/CVE-2026-48710"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-48746",
"url": "https://access.redhat.com/security/cve/CVE-2026-48746"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-48990",
"url": "https://access.redhat.com/security/cve/CVE-2026-48990"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-5422",
"url": "https://access.redhat.com/security/cve/CVE-2026-5422"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54283",
"url": "https://access.redhat.com/security/cve/CVE-2026-54283"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-59939",
"url": "https://access.redhat.com/security/cve/CVE-2026-59939"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-6322",
"url": "https://access.redhat.com/security/cve/CVE-2026-6322"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://developers.redhat.com/products/mta/overview",
"url": "https://developers.redhat.com/products/mta/overview"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/migration_toolkit_for_applications/",
"url": "https://docs.redhat.com/en/documentation/migration_toolkit_for_applications/"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_43038.json"
}
],
"title": "Red Hat Security Advisory: Migration Toolkit for Applications",
"tracking": {
"current_release_date": "2026-08-12T05:58:51+00:00",
"generator": {
"date": "2026-08-12T05:58:51+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.14"
}
},
"id": "RHSA-2026:43038",
"initial_release_date": "2026-07-21T22:10:10+00:00",
"revision_history": [
{
"date": "2026-07-21T22:10:10+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-08-08T04:36:23+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-12T05:58:51+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Migration Toolkit for Applications 8.2",
"product": {
"name": "Red Hat Migration Toolkit for Applications 8.2",
"product_id": "Red Hat Migration Toolkit for Applications 8.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:migration_toolkit_applications:8.2::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat Migration Toolkit for Applications"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"product": {
"name": "registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"product_id": "registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"product_identification_helper": {
"purl": "pkg:oci/mta-analyzer-addon-rhel9@sha256%3A1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53?arch=amd64\u0026repository_url=registry.redhat.io/mta/mta-analyzer-addon-rhel9\u0026tag=1784163267"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"product": {
"name": "registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"product_id": "registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"product_identification_helper": {
"purl": "pkg:oci/mta-cli-rhel9@sha256%3Ad466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7?arch=amd64\u0026repository_url=registry.redhat.io/mta/mta-cli-rhel9\u0026tag=1784211378"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"product": {
"name": "registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"product_id": "registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"product_identification_helper": {
"purl": "pkg:oci/mta-discovery-addon-rhel9@sha256%3Aa72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36?arch=amd64\u0026repository_url=registry.redhat.io/mta/mta-discovery-addon-rhel9\u0026tag=1784056873"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"product": {
"name": "registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"product_id": "registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"product_identification_helper": {
"purl": "pkg:oci/mta-dotnet-external-provider-rhel9@sha256%3A794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b?arch=amd64\u0026repository_url=registry.redhat.io/mta/mta-dotnet-external-provider-rhel9\u0026tag=1784056823"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"product": {
"name": "registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"product_id": "registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"product_identification_helper": {
"purl": "pkg:oci/mta-go-external-provider-rhel9@sha256%3A8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d?arch=amd64\u0026repository_url=registry.redhat.io/mta/mta-go-external-provider-rhel9\u0026tag=1784162259"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"product": {
"name": "registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"product_id": "registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"product_identification_helper": {
"purl": "pkg:oci/mta-hub-rhel9@sha256%3A2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485?arch=amd64\u0026repository_url=registry.redhat.io/mta/mta-hub-rhel9\u0026tag=1784059743"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"product": {
"name": "registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"product_id": "registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"product_identification_helper": {
"purl": "pkg:oci/mta-java-external-provider-rhel9@sha256%3Ae8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd?arch=amd64\u0026repository_url=registry.redhat.io/mta/mta-java-external-provider-rhel9\u0026tag=1784210217"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"product": {
"name": "registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"product_id": "registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"product_identification_helper": {
"purl": "pkg:oci/mta-nodejs-external-provider-rhel9@sha256%3A12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6?arch=amd64\u0026repository_url=registry.redhat.io/mta/mta-nodejs-external-provider-rhel9\u0026tag=1784162266"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"product": {
"name": "registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"product_id": "registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"product_identification_helper": {
"purl": "pkg:oci/mta-rhel9-operator@sha256%3A3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0?arch=amd64\u0026repository_url=registry.redhat.io/mta/mta-rhel9-operator\u0026tag=1784219586"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"product": {
"name": "registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"product_id": "registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"product_identification_helper": {
"purl": "pkg:oci/mta-operator-bundle@sha256%3A94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf?arch=amd64\u0026repository_url=registry.redhat.io/mta/mta-operator-bundle\u0026tag=1784220119"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"product": {
"name": "registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"product_id": "registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"product_identification_helper": {
"purl": "pkg:oci/mta-platform-addon-rhel9@sha256%3Af421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf?arch=amd64\u0026repository_url=registry.redhat.io/mta/mta-platform-addon-rhel9\u0026tag=1784059659"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"product": {
"name": "registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"product_id": "registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"product_identification_helper": {
"purl": "pkg:oci/mta-python-external-provider-rhel9@sha256%3A4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1?arch=amd64\u0026repository_url=registry.redhat.io/mta/mta-python-external-provider-rhel9\u0026tag=1784162359"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"product": {
"name": "registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"product_id": "registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"product_identification_helper": {
"purl": "pkg:oci/mta-solution-server-rhel9@sha256%3A21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23?arch=amd64\u0026repository_url=registry.redhat.io/mta/mta-solution-server-rhel9\u0026tag=1784109883"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"product": {
"name": "registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"product_id": "registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"product_identification_helper": {
"purl": "pkg:oci/mta-ui-rhel9@sha256%3Aa77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1?arch=amd64\u0026repository_url=registry.redhat.io/mta/mta-ui-rhel9\u0026tag=1783962515"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"product": {
"name": "registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"product_id": "registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"product_identification_helper": {
"purl": "pkg:oci/mta-analyzer-addon-rhel9@sha256%3A907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6?arch=arm64\u0026repository_url=registry.redhat.io/mta/mta-analyzer-addon-rhel9\u0026tag=1784163267"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"product": {
"name": "registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"product_id": "registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"product_identification_helper": {
"purl": "pkg:oci/mta-cli-rhel9@sha256%3Aecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab?arch=arm64\u0026repository_url=registry.redhat.io/mta/mta-cli-rhel9\u0026tag=1784211378"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"product": {
"name": "registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"product_id": "registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"product_identification_helper": {
"purl": "pkg:oci/mta-discovery-addon-rhel9@sha256%3A7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace?arch=arm64\u0026repository_url=registry.redhat.io/mta/mta-discovery-addon-rhel9\u0026tag=1784056873"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"product": {
"name": "registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"product_id": "registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"product_identification_helper": {
"purl": "pkg:oci/mta-dotnet-external-provider-rhel9@sha256%3Ab5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465?arch=arm64\u0026repository_url=registry.redhat.io/mta/mta-dotnet-external-provider-rhel9\u0026tag=1784056823"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"product": {
"name": "registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"product_id": "registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"product_identification_helper": {
"purl": "pkg:oci/mta-go-external-provider-rhel9@sha256%3A8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b?arch=arm64\u0026repository_url=registry.redhat.io/mta/mta-go-external-provider-rhel9\u0026tag=1784162259"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"product": {
"name": "registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"product_id": "registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"product_identification_helper": {
"purl": "pkg:oci/mta-hub-rhel9@sha256%3A0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415?arch=arm64\u0026repository_url=registry.redhat.io/mta/mta-hub-rhel9\u0026tag=1784059743"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"product": {
"name": "registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"product_id": "registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"product_identification_helper": {
"purl": "pkg:oci/mta-java-external-provider-rhel9@sha256%3A60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2?arch=arm64\u0026repository_url=registry.redhat.io/mta/mta-java-external-provider-rhel9\u0026tag=1784210217"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"product": {
"name": "registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"product_id": "registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"product_identification_helper": {
"purl": "pkg:oci/mta-nodejs-external-provider-rhel9@sha256%3Aa89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844?arch=arm64\u0026repository_url=registry.redhat.io/mta/mta-nodejs-external-provider-rhel9\u0026tag=1784162266"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"product": {
"name": "registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"product_id": "registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"product_identification_helper": {
"purl": "pkg:oci/mta-rhel9-operator@sha256%3A957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a?arch=arm64\u0026repository_url=registry.redhat.io/mta/mta-rhel9-operator\u0026tag=1784219586"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"product": {
"name": "registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"product_id": "registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"product_identification_helper": {
"purl": "pkg:oci/mta-platform-addon-rhel9@sha256%3A647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240?arch=arm64\u0026repository_url=registry.redhat.io/mta/mta-platform-addon-rhel9\u0026tag=1784059659"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"product": {
"name": "registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"product_id": "registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"product_identification_helper": {
"purl": "pkg:oci/mta-python-external-provider-rhel9@sha256%3A25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228?arch=arm64\u0026repository_url=registry.redhat.io/mta/mta-python-external-provider-rhel9\u0026tag=1784162359"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"product": {
"name": "registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"product_id": "registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"product_identification_helper": {
"purl": "pkg:oci/mta-solution-server-rhel9@sha256%3Af8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e?arch=arm64\u0026repository_url=registry.redhat.io/mta/mta-solution-server-rhel9\u0026tag=1784109883"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64",
"product": {
"name": "registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64",
"product_id": "registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64",
"product_identification_helper": {
"purl": "pkg:oci/mta-ui-rhel9@sha256%3Af59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7?arch=arm64\u0026repository_url=registry.redhat.io/mta/mta-ui-rhel9\u0026tag=1783962515"
}
}
}
],
"category": "architecture",
"name": "arm64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64 as a component of Red Hat Migration Toolkit for Applications 8.2",
"product_id": "Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64"
},
"product_reference": "registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"relates_to_product_reference": "Red Hat Migration Toolkit for Applications 8.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64 as a component of Red Hat Migration Toolkit for Applications 8.2",
"product_id": "Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64"
},
"product_reference": "registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"relates_to_product_reference": "Red Hat Migration Toolkit for Applications 8.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64 as a component of Red Hat Migration Toolkit for Applications 8.2",
"product_id": "Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64"
},
"product_reference": "registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"relates_to_product_reference": "Red Hat Migration Toolkit for Applications 8.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64 as a component of Red Hat Migration Toolkit for Applications 8.2",
"product_id": "Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64"
},
"product_reference": "registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"relates_to_product_reference": "Red Hat Migration Toolkit for Applications 8.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64 as a component of Red Hat Migration Toolkit for Applications 8.2",
"product_id": "Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64"
},
"product_reference": "registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"relates_to_product_reference": "Red Hat Migration Toolkit for Applications 8.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64 as a component of Red Hat Migration Toolkit for Applications 8.2",
"product_id": "Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64"
},
"product_reference": "registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"relates_to_product_reference": "Red Hat Migration Toolkit for Applications 8.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64 as a component of Red Hat Migration Toolkit for Applications 8.2",
"product_id": "Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64"
},
"product_reference": "registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"relates_to_product_reference": "Red Hat Migration Toolkit for Applications 8.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64 as a component of Red Hat Migration Toolkit for Applications 8.2",
"product_id": "Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64"
},
"product_reference": "registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"relates_to_product_reference": "Red Hat Migration Toolkit for Applications 8.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64 as a component of Red Hat Migration Toolkit for Applications 8.2",
"product_id": "Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64"
},
"product_reference": "registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"relates_to_product_reference": "Red Hat Migration Toolkit for Applications 8.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64 as a component of Red Hat Migration Toolkit for Applications 8.2",
"product_id": "Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64"
},
"product_reference": "registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"relates_to_product_reference": "Red Hat Migration Toolkit for Applications 8.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64 as a component of Red Hat Migration Toolkit for Applications 8.2",
"product_id": "Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64"
},
"product_reference": "registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"relates_to_product_reference": "Red Hat Migration Toolkit for Applications 8.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64 as a component of Red Hat Migration Toolkit for Applications 8.2",
"product_id": "Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64"
},
"product_reference": "registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"relates_to_product_reference": "Red Hat Migration Toolkit for Applications 8.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64 as a component of Red Hat Migration Toolkit for Applications 8.2",
"product_id": "Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64"
},
"product_reference": "registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"relates_to_product_reference": "Red Hat Migration Toolkit for Applications 8.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64 as a component of Red Hat Migration Toolkit for Applications 8.2",
"product_id": "Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64"
},
"product_reference": "registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"relates_to_product_reference": "Red Hat Migration Toolkit for Applications 8.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64 as a component of Red Hat Migration Toolkit for Applications 8.2",
"product_id": "Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64"
},
"product_reference": "registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"relates_to_product_reference": "Red Hat Migration Toolkit for Applications 8.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64 as a component of Red Hat Migration Toolkit for Applications 8.2",
"product_id": "Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64"
},
"product_reference": "registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"relates_to_product_reference": "Red Hat Migration Toolkit for Applications 8.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64 as a component of Red Hat Migration Toolkit for Applications 8.2",
"product_id": "Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64"
},
"product_reference": "registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"relates_to_product_reference": "Red Hat Migration Toolkit for Applications 8.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64 as a component of Red Hat Migration Toolkit for Applications 8.2",
"product_id": "Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64"
},
"product_reference": "registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"relates_to_product_reference": "Red Hat Migration Toolkit for Applications 8.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64 as a component of Red Hat Migration Toolkit for Applications 8.2",
"product_id": "Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64"
},
"product_reference": "registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"relates_to_product_reference": "Red Hat Migration Toolkit for Applications 8.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64 as a component of Red Hat Migration Toolkit for Applications 8.2",
"product_id": "Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64"
},
"product_reference": "registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"relates_to_product_reference": "Red Hat Migration Toolkit for Applications 8.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64 as a component of Red Hat Migration Toolkit for Applications 8.2",
"product_id": "Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64"
},
"product_reference": "registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"relates_to_product_reference": "Red Hat Migration Toolkit for Applications 8.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64 as a component of Red Hat Migration Toolkit for Applications 8.2",
"product_id": "Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64"
},
"product_reference": "registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"relates_to_product_reference": "Red Hat Migration Toolkit for Applications 8.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64 as a component of Red Hat Migration Toolkit for Applications 8.2",
"product_id": "Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64"
},
"product_reference": "registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"relates_to_product_reference": "Red Hat Migration Toolkit for Applications 8.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64 as a component of Red Hat Migration Toolkit for Applications 8.2",
"product_id": "Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64"
},
"product_reference": "registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"relates_to_product_reference": "Red Hat Migration Toolkit for Applications 8.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64 as a component of Red Hat Migration Toolkit for Applications 8.2",
"product_id": "Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
},
"product_reference": "registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"relates_to_product_reference": "Red Hat Migration Toolkit for Applications 8.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64 as a component of Red Hat Migration Toolkit for Applications 8.2",
"product_id": "Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64"
},
"product_reference": "registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"relates_to_product_reference": "Red Hat Migration Toolkit for Applications 8.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64 as a component of Red Hat Migration Toolkit for Applications 8.2",
"product_id": "Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
},
"product_reference": "registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64",
"relates_to_product_reference": "Red Hat Migration Toolkit for Applications 8.2"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-5422",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-06-02T10:01:06.656531+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2484037"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jupyter-server. This path traversal vulnerability exists due to insufficient validation of file paths, specifically an incorrect root directory boundary check and improper handling of directory traversal sequences. This allows a remote attacker with low privileges to bypass directory restrictions and gain unauthorized read and write access to files in sibling directories. This could lead to the exposure of sensitive data, particularly in shared hosting environments.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jupyter-server: jupyter-server: Sensitive data exposure via path traversal vulnerability",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate vulnerability in jupyter-server allows a remote, low-privileged attacker to bypass directory restrictions. An incorrect root directory boundary check and improper handling of traversal sequences enable unauthorized read and write access to files in sibling directories. This poses a risk of sensitive data exposure, particularly in Red Hat OpenShift AI deployments utilizing shared hosting environments.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-5422"
},
{
"category": "external",
"summary": "RHBZ#2484037",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484037"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-5422",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5422"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5422",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5422"
},
{
"category": "external",
"summary": "https://huntr.com/bounties/24a36953-6490-466f-8cb2-a90d1ca56e0f",
"url": "https://huntr.com/bounties/24a36953-6490-466f-8cb2-a90d1ca56e0f"
}
],
"release_date": "2026-06-02T09:11:15.755000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:10:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43038"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "jupyter-server: jupyter-server: Sensitive data exposure via path traversal vulnerability"
},
{
"cve": "CVE-2026-6322",
"cwe": {
"id": "CWE-140",
"name": "Improper Neutralization of Delimiters"
},
"discovery_date": "2026-05-05T11:01:00.332189+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2466684"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in fast-uri. A remote attacker could exploit this vulnerability by crafting a malicious Uniform Resource Identifier (URI) that contains percent-encoded authority delimiters. The fast-uri library incorrectly decodes these delimiters during normalization and then re-emits them as raw separators, which can change the URI\u0027s intended authority. This issue allows applications that perform host allowlist checks, redirect validation, or outbound request routing to be steered to a different authority than specified, potentially bypassing security controls.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "fast-uri: fast-uri: URI authority bypass due to improper delimiter handling",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in the `fast-uri` library allows an attacker to bypass security controls in Red Hat products that process Uniform Resource Identifiers (URIs). By crafting a malicious URI with percent-encoded authority delimiters, an attacker can cause the library to incorrectly interpret the URI\u0027s authority, potentially redirecting applications to an unintended domain. This could lead to a bypass of host allowlist checks, redirect validation, or outbound request routing.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-6322"
},
{
"category": "external",
"summary": "RHBZ#2466684",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466684"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-6322",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-6322"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-6322",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6322"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"category": "external",
"summary": "https://github.com/fastify/fast-uri/security/advisories/GHSA-v39h-62p7-jpjc",
"url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-v39h-62p7-jpjc"
}
],
"release_date": "2026-05-05T10:29:16.378000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:10:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43038"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "fast-uri: fast-uri: URI authority bypass due to improper delimiter handling"
},
{
"cve": "CVE-2026-13676",
"cwe": {
"id": "CWE-551",
"name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
},
"discovery_date": "2026-06-29T14:01:55.592330+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2494197"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in fast-uri. This vulnerability occurs because fast-uri fails to properly convert Unicode (Internationalized Domain Name - IDN) hostnames for HTTP-family URLs. This can lead to a situation where security policies, such as denylists or redirect validations, are bypassed when applications use fast-uri to enforce these policies before passing the URL to another parser. A remote attacker could exploit this to circumvent security controls and potentially access unauthorized resources or perform malicious redirects.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in `fast-uri` allows a remote attacker to bypass host-based security policies. Applications that rely on `fast-uri` for URL parsing and policy enforcement, such as denylists or redirect validations, can be circumvented due to inconsistent handling of Unicode hostnames. This discrepancy between `fast-uri` and other URL parsers could lead to unauthorized resource access or malicious redirects in affected Red Hat products.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-13676"
},
{
"category": "external",
"summary": "RHBZ#2494197",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494197"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-13676",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-13676"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-13676",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13676"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"category": "external",
"summary": "https://github.com/fastify/fast-uri/security/advisories/GHSA-4c8g-83qw-93j6",
"url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-4c8g-83qw-93j6"
}
],
"release_date": "2026-06-29T13:22:44.674000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:10:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43038"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization"
},
{
"cve": "CVE-2026-25681",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2026-05-22T16:01:08.177603+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480761"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/net/html. A remote attacker could exploit this vulnerability by providing specially crafted HTML. When this arbitrary HTML is parsed and rendered, it can result in an unexpected HTML tree, bypassing input sanitization. This can be leveraged to execute Cross-Site Scripting (XSS) attacks, potentially leading to arbitrary code execution in applications that use the affected component.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important vulnerability in `golang.org/x/net/html` could enable remote attackers to execute Cross-Site Scripting (XSS) attacks, potentially leading to arbitrary code execution. The flaw allows specially crafted HTML to bypass input sanitization during parsing and rendering. Red Hat products are affected if they process untrusted HTML content using the vulnerable component without additional output encoding or robust content security policies.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-25681"
},
{
"category": "external",
"summary": "RHBZ#2480761",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480761"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-25681",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25681"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25681",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25681"
},
{
"category": "external",
"summary": "https://go.dev/cl/781703",
"url": "https://go.dev/cl/781703"
},
{
"category": "external",
"summary": "https://go.dev/issue/79574",
"url": "https://go.dev/issue/79574"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8",
"url": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5029",
"url": "https://pkg.go.dev/vuln/GO-2026-5029"
}
],
"release_date": "2026-05-22T15:01:21.975000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:10:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43038"
},
{
"category": "workaround",
"details": "To mitigate this flaw, applications processing untrusted HTML input must implement strict input sanitization and ensure all output is properly encoded before rendering. Deploying a comprehensive Content Security Policy (CSP) can restrict script execution, further reducing the attack surface. Administrators should review application configurations to ensure adequate protection against XSS.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting"
},
{
"cve": "CVE-2026-27136",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2026-05-22T16:00:56.609820+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480757"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/net/html. When arbitrary HTML is parsed and then rendered, it can result in an unexpected HTML tree. This allows an attacker to bypass HTML sanitization mechanisms, leading to Cross-Site Scripting (XSS) attacks in applications. Such attacks can result in information disclosure or arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability in `golang.org/x/net/html` is rated as Important. It allows for Cross-Site Scripting (XSS) attacks by enabling an attacker to bypass HTML sanitization mechanisms when arbitrary HTML is parsed and rendered. This can lead to information disclosure or arbitrary code execution in affected applications. Exploitation typically requires user interaction, where a user processes specially crafted malicious HTML content.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27136"
},
{
"category": "external",
"summary": "RHBZ#2480757",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480757"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27136",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27136"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27136",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27136"
},
{
"category": "external",
"summary": "https://go.dev/cl/781685",
"url": "https://go.dev/cl/781685"
},
{
"category": "external",
"summary": "https://go.dev/issue/79575",
"url": "https://go.dev/issue/79575"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8",
"url": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5030",
"url": "https://pkg.go.dev/vuln/GO-2026-5030"
}
],
"release_date": "2026-05-22T15:01:22.111000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:10:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43038"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass"
},
{
"cve": "CVE-2026-28684",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"discovery_date": "2026-04-20T17:02:18.205732+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2459798"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in python-dotenv. A local attacker can exploit this by crafting a symbolic link, which the `set_key()` and `unset_key()` functions in python-dotenv follow when rewriting `.env` files. This can lead to the overwriting of arbitrary files on the system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-dotenv: python-dotenv: Arbitrary file overwrite via symbolic link following",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-28684"
},
{
"category": "external",
"summary": "RHBZ#2459798",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2459798"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-28684",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28684"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-28684",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28684"
},
{
"category": "external",
"summary": "https://github.com/theskumar/python-dotenv/commit/790c5c02991100aa1bf41ee5330aca75edc51311",
"url": "https://github.com/theskumar/python-dotenv/commit/790c5c02991100aa1bf41ee5330aca75edc51311"
},
{
"category": "external",
"summary": "https://github.com/theskumar/python-dotenv/releases/tag/v1.2.2",
"url": "https://github.com/theskumar/python-dotenv/releases/tag/v1.2.2"
},
{
"category": "external",
"summary": "https://github.com/theskumar/python-dotenv/security/advisories/GHSA-mf9w-mj56-hr94",
"url": "https://github.com/theskumar/python-dotenv/security/advisories/GHSA-mf9w-mj56-hr94"
}
],
"release_date": "2026-04-20T16:25:12.302000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:10:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43038"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "python-dotenv: python-dotenv: Arbitrary file overwrite via symbolic link following"
},
{
"cve": "CVE-2026-33079",
"cwe": {
"id": "CWE-1333",
"name": "Inefficient Regular Expression Complexity"
},
"discovery_date": "2026-05-06T18:01:13.818581+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467298"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Mistune, a Markdown parser. This vulnerability, known as Regular Expression Denial of Service (ReDoS), exists in the `LINK_TITLE_RE` regular expression. A remote attacker can exploit this by providing specially crafted Markdown input, which causes the regular expression engine to engage in catastrophic backtracking. This leads to significant CPU consumption, making applications that use Mistune unresponsive and resulting in a Denial of Service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "mistune: Mistune: Regular Expression Denial of Service (ReDoS) via crafted Markdown input",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in the Mistune Markdown parser can lead to a denial of service in Red Hat OpenShift AI and Migration Toolkit for Applications. A remote attacker can exploit a Regular Expression Denial of Service (ReDoS) vulnerability by submitting specially crafted Markdown input, causing excessive CPU consumption and rendering affected applications unresponsive. This impact is significant as it directly affects the availability of services that process untrusted Markdown content.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33079"
},
{
"category": "external",
"summary": "RHBZ#2467298",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467298"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33079",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33079"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33079",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33079"
},
{
"category": "external",
"summary": "https://github.com/lepture/mistune/blob/df23edd60b43b639d2e6760ef9dd3d618aa11c21/src/mistune/helpers.py#L20-L25",
"url": "https://github.com/lepture/mistune/blob/df23edd60b43b639d2e6760ef9dd3d618aa11c21/src/mistune/helpers.py#L20-L25"
},
{
"category": "external",
"summary": "https://github.com/lepture/mistune/security/advisories/GHSA-8mp2-v27r-99xp",
"url": "https://github.com/lepture/mistune/security/advisories/GHSA-8mp2-v27r-99xp"
}
],
"release_date": "2026-05-06T17:25:09.026000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:10:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43038"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "mistune: Mistune: Regular Expression Denial of Service (ReDoS) via crafted Markdown input"
},
{
"cve": "CVE-2026-33811",
"cwe": {
"id": "CWE-1341",
"name": "Multiple Releases of Same Resource or Handle"
},
"discovery_date": "2026-05-07T20:01:34.913869+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467822"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `net` package of Go (golang), specifically when using the `LookupCNAME` function with the `cgo` DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name (CNAME) response. This can trigger a double-free of C memory, leading to a crash and a Denial of Service (DoS) for the affected application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in the Go `net` package, affecting applications configured to use the `cgo` DNS resolver. A remote attacker could trigger a double-free memory error by providing a very long CNAME response, leading to a crash of the vulnerable application and impacting service availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33811"
},
{
"category": "external",
"summary": "RHBZ#2467822",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467822"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33811",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33811"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33811",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33811"
},
{
"category": "external",
"summary": "https://go.dev/cl/767860",
"url": "https://go.dev/cl/767860"
},
{
"category": "external",
"summary": "https://go.dev/issue/78803",
"url": "https://go.dev/issue/78803"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
"url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4981",
"url": "https://pkg.go.dev/vuln/GO-2026-4981"
}
],
"release_date": "2026-05-07T19:41:19.285000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:10:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43038"
},
{
"category": "workaround",
"details": "To mitigate this issue, applications can be configured to use the pure Go DNS resolver instead of the `cgo` DNS resolver. This can be achieved by setting the `GODEBUG` environment variable to `netdns=go`. For example, to run a Go application with this mitigation: `GODEBUG=netdns=go /path/to/your/go/application`. This change may require restarting affected applications or services to take effect. Users should verify that this change does not negatively impact DNS resolution for their specific application environment.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME"
},
{
"cve": "CVE-2026-34993",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-06-02T20:01:12.690409+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2484099"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework for asyncio and Python. An attacker could exploit this vulnerability by providing untrusted input to the `CookieJar.load()` function. This could potentially lead to arbitrary code execution, allowing the attacker to run malicious code on the affected system. This issue is most likely to occur in applications that allow attacker-controlled files to be loaded.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "aiohttp: AIOHTTP: Arbitrary code execution via untrusted input to CookieJar.load()",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in AIOHTTP, a Python asynchronous HTTP framework, due to potential arbitrary code execution. The vulnerability arises when applications load untrusted input into the `CookieJar.load()` function. Exploitation requires an application to be configured to process attacker-controlled files, which is not a default or common scenario in most Red Hat product deployments.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-34993"
},
{
"category": "external",
"summary": "RHBZ#2484099",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484099"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-34993",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34993"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34993",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34993"
},
{
"category": "external",
"summary": "https://github.com/aio-libs/aiohttp/commit/dcf40f30637e8752c76781cf6703b5a236749a00",
"url": "https://github.com/aio-libs/aiohttp/commit/dcf40f30637e8752c76781cf6703b5a236749a00"
},
{
"category": "external",
"summary": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-jg22-mg44-37j8",
"url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-jg22-mg44-37j8"
}
],
"release_date": "2026-06-02T18:29:15.847000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:10:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43038"
},
{
"category": "workaround",
"details": "Applications using AIOHTTP that are configured to load untrusted files via the `CookieJar.load()` function should implement input sanitization prior to loading. This prevents the injection of malicious code.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "aiohttp: AIOHTTP: Arbitrary code execution via untrusted input to CookieJar.load()"
},
{
"cve": "CVE-2026-35397",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-05-05T20:01:20.132731+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2466858"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jupyter Server. An authenticated user can exploit a path traversal vulnerability in the REST API to escape the configured root directory (`root_dir`). By crafting a request to the `/api/contents` endpoint with encoded path components, an attacker can gain access to sibling directories whose names begin with the same prefix as the `root_dir`. This allows the attacker to read, write, and delete files in these accessible sibling directories, potentially leading to unauthorized data access and modification, especially in multi-tenant environments.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jupyter-server: Jupyter Server: Unauthorized File Access via Path Traversal Vulnerability",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in Jupyter Server enables an authenticated user to bypass their configured root directory via a path traversal vulnerability in the REST API. This allows access to, and manipulation of, files within sibling directories that share a common prefix. The risk is elevated in multi-tenant Red Hat OpenShift AI environments where predictable directory naming conventions are often employed.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-35397"
},
{
"category": "external",
"summary": "RHBZ#2466858",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466858"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-35397",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-35397"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-35397",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35397"
},
{
"category": "external",
"summary": "https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-5789-5fc7-67v3",
"url": "https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-5789-5fc7-67v3"
}
],
"release_date": "2026-05-05T19:37:33.810000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:10:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43038"
},
{
"category": "workaround",
"details": "To mitigate this issue, ensure that directory names within Jupyter Server deployments do not share common prefixes with sibling directories. This operational control prevents authenticated users from exploiting the path traversal vulnerability to access unauthorized content. For example, avoid naming directories \u0027user1\u0027 and \u0027user10\u0027 if \u0027user\u0027 is a common prefix. This mitigation does not require service restarts or reloads.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jupyter-server: Jupyter Server: Unauthorized File Access via Path Traversal Vulnerability"
},
{
"cve": "CVE-2026-39820",
"cwe": {
"id": "CWE-606",
"name": "Unchecked Input for Loop Condition"
},
"discovery_date": "2026-05-07T20:01:27.800929+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467820"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `net/mail` package of the Go programming language. An attacker could provide specially crafted inputs to the `ParseAddress`, `ParseAddressList`, or `ParseDate` functions. This could lead to excessive consumption of CPU and memory resources, resulting in a Denial of Service (DoS) for applications processing these inputs.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/mail: golang: Go net/mail: Denial of Service via crafted email inputs",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in the Go `net/mail` package. Applications processing untrusted email inputs via `ParseAddress`, `ParseAddressList`, or `ParseDate` functions are susceptible to excessive resource consumption, which can lead to service unavailability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39820"
},
{
"category": "external",
"summary": "RHBZ#2467820",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467820"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39820",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39820"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39820",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39820"
},
{
"category": "external",
"summary": "https://go.dev/cl/759940",
"url": "https://go.dev/cl/759940"
},
{
"category": "external",
"summary": "https://go.dev/issue/78566",
"url": "https://go.dev/issue/78566"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
"url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4986",
"url": "https://pkg.go.dev/vuln/GO-2026-4986"
}
],
"release_date": "2026-05-07T19:41:19.854000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:10:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43038"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net/mail: golang: Go net/mail: Denial of Service via crafted email inputs"
},
{
"cve": "CVE-2026-39821",
"cwe": {
"id": "CWE-1289",
"name": "Improper Validation of Unsafe Equivalence in Input"
},
"discovery_date": "2026-05-22T16:00:52.844126+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480756"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname (for example, xn--example-.com returns example.com instead of an error). Applications that validate the ASCII form then convert to Unicode may grant access to a restricted hostname the ASCII check would have rejected.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "golang.org/x/net/idna is vulnerable to privilege escalation through incorrect Punycode label handling in ToASCII and ToUnicode. An attacker who can supply a Punycode hostname that passes an ASCII-only authorization check may have it normalized to a restricted ASCII name the application intended to block. Red Hat exposure is broad across products shipping the Go toolchain or bundling golang.org/x/net, including RHEL and RHEL-AI golang RPMs, hummingbird Go runtimes, OpenShift and ODF container builds, and Ceph/OpenShift components compiled against affected x/net versions.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-39821"
},
{
"category": "external",
"summary": "RHBZ#2480756",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480756"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-39821",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-39821"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39821",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39821"
},
{
"category": "external",
"summary": "https://go.dev/cl/767220",
"url": "https://go.dev/cl/767220"
},
{
"category": "external",
"summary": "https://go.dev/issue/78760",
"url": "https://go.dev/issue/78760"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8",
"url": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5026",
"url": "https://pkg.go.dev/vuln/GO-2026-5026"
}
],
"release_date": "2026-05-22T15:01:21.462000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:10:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43038"
},
{
"category": "workaround",
"details": "Upgrade to a fixed golang.org/x/net release that includes the idna correction, via updated golang or dependent package rebuilds.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing"
},
{
"cve": "CVE-2026-40110",
"cwe": {
"id": "CWE-625",
"name": "Permissive Regular Expression"
},
"discovery_date": "2026-05-05T22:01:09.643884+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2466912"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jupyter Server. The Origin header validation, which uses Python\u0027s `re.match()` function, does not correctly validate incoming origins against allowed patterns. This allows a remote attacker to bypass Cross-Origin Resource Sharing (CORS) restrictions by crafting a malicious domain that partially matches a trusted one. Consequently, the attacker can make unauthorized cross-origin requests to the Jupyter Server API from an untrusted site, potentially leading to sensitive information disclosure or other unauthorized actions.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jupyter-server: Jupyter Server: Cross-Origin Resource Sharing (CORS) bypass via improper Origin header validation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-40110"
},
{
"category": "external",
"summary": "RHBZ#2466912",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466912"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-40110",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40110"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40110",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40110"
},
{
"category": "external",
"summary": "https://github.com/jupyter-server/jupyter_server/commit/057869a327c46730afede3eab0ca2d2e3e74acea",
"url": "https://github.com/jupyter-server/jupyter_server/commit/057869a327c46730afede3eab0ca2d2e3e74acea"
},
{
"category": "external",
"summary": "https://github.com/jupyter-server/jupyter_server/commit/49b34392feaa97735b3b777e3baf8f22f2a14ed8",
"url": "https://github.com/jupyter-server/jupyter_server/commit/49b34392feaa97735b3b777e3baf8f22f2a14ed8"
},
{
"category": "external",
"summary": "https://github.com/jupyter-server/jupyter_server/pull/603",
"url": "https://github.com/jupyter-server/jupyter_server/pull/603"
},
{
"category": "external",
"summary": "https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-24qx-w28j-9m6p",
"url": "https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-24qx-w28j-9m6p"
}
],
"release_date": "2026-05-05T21:29:31.323000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:10:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43038"
},
{
"category": "workaround",
"details": "Administrators should review and update the `allow_origin_pat` configuration in Jupyter Server to use a more precise regular expression. Ensure the pattern explicitly anchors to the end of the string (e.g., by adding `$` to the end of the regex) to prevent partial domain matches. After modifying the configuration, the Jupyter Server service must be restarted for the changes to take effect.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jupyter-server: Jupyter Server: Cross-Origin Resource Sharing (CORS) bypass via improper Origin header validation"
},
{
"cve": "CVE-2026-40171",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2026-05-06T20:00:54.861152+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467453"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jupyter Notebook and JupyterLab. A stored cross-site scripting (XSS) vulnerability in the help command linker can be exploited by an attacker who crafts a malicious notebook file. When a user interacts with this file, the XSS is triggered, allowing the attacker to steal authentication tokens. Successful exploitation can lead to a complete takeover of the Jupyter session, enabling arbitrary code execution and information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Jupyter Notebook: JupyterLab: @jupyter-notebook/help-extension: @jupyterlab/help-extension: Jupyter Notebook and JupyterLab: Session takeover via stored cross-site scripting",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in Jupyter Notebook and JupyterLab, enabling a stored cross-site scripting (XSS) attack. An attacker can craft a malicious notebook that, with a single user click, can steal authentication tokens and fully compromise the Jupyter session, leading to arbitrary code execution and information disclosure. This impacts Red Hat OpenShift AI and Migration Toolkit for Applications.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-40171"
},
{
"category": "external",
"summary": "RHBZ#2467453",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467453"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-40171",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40171"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40171",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40171"
},
{
"category": "external",
"summary": "https://github.com/jupyter/notebook/security/advisories/GHSA-rch3-82jr-f9w9",
"url": "https://github.com/jupyter/notebook/security/advisories/GHSA-rch3-82jr-f9w9"
}
],
"release_date": "2026-05-06T19:36:32.072000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:10:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43038"
},
{
"category": "workaround",
"details": "To reduce the risk of exploitation, disable the affected help extensions in Jupyter Notebook and JupyterLab, or set the `allowCommandLinker` option to `false` within the sanitizer configuration. Consult the Jupyter documentation for specific instructions on modifying these settings. Disabling these features may affect the availability of certain help functionalities.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Jupyter Notebook: JupyterLab: @jupyter-notebook/help-extension: @jupyterlab/help-extension: Jupyter Notebook and JupyterLab: Session takeover via stored cross-site scripting"
},
{
"cve": "CVE-2026-42266",
"cwe": {
"id": "CWE-88",
"name": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)"
},
"discovery_date": "2026-05-13T16:02:13.807767+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477072"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in JupyterLab, an extensible environment for interactive computing. The PyPI Extension Manager, responsible for installing extensions, failed to properly enforce its allow-list of approved extensions. This vulnerability allowed for the installation of unauthorized extensions from sources outside the default PyPI index. Exploitation of this flaw could lead to arbitrary code execution and significant system compromise.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jupyterlab: JupyterLab: Arbitrary code execution due to improper enforcement of extension allow-list",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in JupyterLab, as utilized in Red Hat OpenShift AI and Migration Toolkit for Applications, stems from the PyPI Extension Manager\u0027s failure to enforce its extension allow-list. This enables the installation of unauthorized extensions from external sources, potentially leading to arbitrary code execution and significant system compromise within the JupyterLab environment.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42266"
},
{
"category": "external",
"summary": "RHBZ#2477072",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477072"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42266",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42266"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42266",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42266"
},
{
"category": "external",
"summary": "https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-37w4-hwhx-4rc4",
"url": "https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-37w4-hwhx-4rc4"
}
],
"release_date": "2026-05-13T15:08:49.846000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:10:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43038"
},
{
"category": "workaround",
"details": "Upgrade JupyterLab to version 4.5.7 or later.\n\nSet the JupyterLab extension manager to read-only mode to prevent users from installing unauthorized extensions. Note: configuring a PyPI proxy with an allow list of packages is not sufficient to protect against this vulnerability.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jupyterlab: JupyterLab: Arbitrary code execution due to improper enforcement of extension allow-list"
},
{
"cve": "CVE-2026-42499",
"cwe": {
"id": "CWE-1046",
"name": "Creation of Immutable Text Using String Concatenation"
},
"discovery_date": "2026-05-07T20:00:51.685602+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467809"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `net/mail` package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the `consumePhrase` function, it can lead to excessive resource consumption due to quadratic string concatenation, resulting in a Denial of Service (DoS) condition.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/mail: golang: net/mail: Denial of Service via pathological email address parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in the `net/mail` package of the Go standard library. A remote attacker can exploit this flaw by sending specially crafted email addresses, leading to excessive resource consumption and a denial of service in Go applications that parse email addresses using the affected library.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42499"
},
{
"category": "external",
"summary": "RHBZ#2467809",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467809"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42499",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42499"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42499",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42499"
},
{
"category": "external",
"summary": "https://go.dev/cl/771520",
"url": "https://go.dev/cl/771520"
},
{
"category": "external",
"summary": "https://go.dev/issue/78987",
"url": "https://go.dev/issue/78987"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
"url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4977",
"url": "https://pkg.go.dev/vuln/GO-2026-4977"
}
],
"release_date": "2026-05-07T19:41:18.615000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:10:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43038"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net/mail: golang: net/mail: Denial of Service via pathological email address parsing"
},
{
"cve": "CVE-2026-42504",
"cwe": {
"id": "CWE-1050",
"name": "Excessive Platform Resource Consumption within a Loop"
},
"discovery_date": "2026-06-02T23:01:00.320527+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2484204"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Golang MIME (Multipurpose Internet Mail Extensions) package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service (DoS) for the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is rated as an Important severity flaw. A remote attacker could trigger a Denial of Service by sending a crafted MIME header with numerous invalid encoded-words to an application utilizing the affected Golang MIME package. This could lead to excessive CPU consumption on the system processing the malformed header, impacting service availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42504"
},
{
"category": "external",
"summary": "RHBZ#2484204",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484204"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42504",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42504"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42504",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42504"
},
{
"category": "external",
"summary": "https://go.dev/cl/774481",
"url": "https://go.dev/cl/774481"
},
{
"category": "external",
"summary": "https://go.dev/issue/79217",
"url": "https://go.dev/issue/79217"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw",
"url": "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-5038",
"url": "https://pkg.go.dev/vuln/GO-2026-5038"
}
],
"release_date": "2026-06-02T22:01:37.219000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:10:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43038"
},
{
"category": "workaround",
"details": "To mitigate this issue, restrict network access to services that process MIME headers from untrusted sources. Implement input validation and sanitization for all incoming data, especially MIME headers, to prevent maliciously crafted content from being processed by applications utilizing the vulnerable Golang MIME package.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header"
},
{
"cve": "CVE-2026-42557",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2026-05-13T16:02:57.063403+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477086"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jupyterlab. This vulnerability allows a remote attacker to achieve arbitrary code execution by presenting a user with a specially crafted notebook containing a deceptive button in its pre-saved HTML cell output. When the user clicks this button, the CommandLinker component executes arbitrary JupyterLab commands without sufficient validation, leading to the execution of unauthorized code.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jupyterlab: JupyterLab: Arbitrary code execution via deceptive button in HTML output",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important vulnerability in JupyterLab allows arbitrary code execution through a deceptive button embedded in a notebook\u0027s HTML output. When a user clicks this specially crafted button, the CommandLinker component executes unauthorized JupyterLab commands, bypassing security validation. This can lead to compromise of the user\u0027s environment, including data loss or denial of service, particularly in Red Hat products utilizing JupyterLab such as Migration Toolkit for Applications and Red Hat OpenShift AI. Exploitation requires user interaction.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42557"
},
{
"category": "external",
"summary": "RHBZ#2477086",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477086"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42557",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42557"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42557",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42557"
},
{
"category": "external",
"summary": "https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-mqcg-5x36-vfcg",
"url": "https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-mqcg-5x36-vfcg"
}
],
"release_date": "2026-05-13T15:06:14.222000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:10:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43038"
},
{
"category": "workaround",
"details": "Users should avoid opening or interacting with JupyterLab notebooks from untrusted sources. Exercise caution and verify the origin of any notebook before clicking buttons within its output, as this action could lead to the execution of arbitrary commands.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jupyterlab: JupyterLab: Arbitrary code execution via deceptive button in HTML output"
},
{
"cve": "CVE-2026-42561",
"cwe": {
"id": "CWE-606",
"name": "Unchecked Input for Loop Condition"
},
"discovery_date": "2026-05-13T22:01:05.319675+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477309"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in python-multipart. A remote attacker can exploit this denial of service (DoS) vulnerability by sending a specially crafted request with an excessive number of part headers or a single very large header value during multipart/form-data parsing. This can lead to excessive CPU utilization, resulting in a denial of service for the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-multipart: python-multipart: Denial of Service via excessive multipart part headers",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in python-multipart. A remote attacker can trigger excessive CPU utilization by sending specially crafted multipart/form-data requests, leading to service disruption.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42561"
},
{
"category": "external",
"summary": "RHBZ#2477309",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477309"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42561",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42561"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42561",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42561"
},
{
"category": "external",
"summary": "https://github.com/Kludex/python-multipart/security/advisories/GHSA-pp6c-gr5w-3c5g",
"url": "https://github.com/Kludex/python-multipart/security/advisories/GHSA-pp6c-gr5w-3c5g"
}
],
"release_date": "2026-05-13T20:55:11.767000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:10:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43038"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "python-multipart: python-multipart: Denial of Service via excessive multipart part headers"
},
{
"cve": "CVE-2026-44431",
"cwe": {
"id": "CWE-201",
"name": "Insertion of Sensitive Information Into Sent Data"
},
"discovery_date": "2026-05-13T17:01:41.663622+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477167"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in urllib3, an HTTP client library for Python. When using the low-level API via `ProxyManager.connection_from_url().urlopen()` with `assert_same_host=False`, cross-origin redirects can still forward sensitive headers. This could allow a remote attacker to gain unauthorized access to sensitive information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44431"
},
{
"category": "external",
"summary": "RHBZ#2477167",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477167"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44431",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44431"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44431",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44431"
},
{
"category": "external",
"summary": "https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc",
"url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc"
}
],
"release_date": "2026-05-13T15:20:24.588000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:10:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43038"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers"
},
{
"cve": "CVE-2026-44432",
"cwe": {
"id": "CWE-409",
"name": "Improper Handling of Highly Compressed Data (Data Amplification)"
},
"discovery_date": "2026-05-13T17:01:01.083841+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477154"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in urllib3, an HTTP client library for Python. This vulnerability allows a remote attacker to cause excessive resource consumption, such as high CPU usage and massive memory allocation, on the client side. This occurs when urllib3 attempts to decompress an entire HTTP response, even if only a partial read was requested, or when draining the connection after a partial decompression. This can lead to a Denial of Service (DoS) condition.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44432"
},
{
"category": "external",
"summary": "RHBZ#2477154",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477154"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44432",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44432"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44432",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44432"
},
{
"category": "external",
"summary": "https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j",
"url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j"
}
],
"release_date": "2026-05-13T15:17:12.611000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:10:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43038"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression"
},
{
"cve": "CVE-2026-44727",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2026-06-22T21:00:50.127940+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2491516"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Jupyter Server. The nbconvert HTTP handlers in Jupyter Server render user-authored notebook HTML without a sandbox directive in their Content-Security-Policy. This, combined with nbconvert.HTMLExporter\u0027s default non-sanitizing behavior, allows a notebook containing an HTML payload to trigger a stored Cross-Site Scripting (XSS) vulnerability. A remote attacker could exploit this to gain cookie access, full API authority, and achieve kernel Remote Code Execution (RCE).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jupyter-server: Jupyter Server: Remote Code Execution via stored Cross-Site Scripting in nbconvert handlers",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44727"
},
{
"category": "external",
"summary": "RHBZ#2491516",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491516"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44727",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44727"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44727",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44727"
},
{
"category": "external",
"summary": "https://github.com/jupyter-server/jupyter_server/commit/6cbee8d65e71abac851c4492fea987ad080580bd",
"url": "https://github.com/jupyter-server/jupyter_server/commit/6cbee8d65e71abac851c4492fea987ad080580bd"
},
{
"category": "external",
"summary": "https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-fcw5-x6j4-ccmp",
"url": "https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-fcw5-x6j4-ccmp"
}
],
"release_date": "2026-06-22T19:56:56.776000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:10:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43038"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.0,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jupyter-server: Jupyter Server: Remote Code Execution via stored Cross-Site Scripting in nbconvert handlers"
},
{
"cve": "CVE-2026-44843",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-05-26T21:01:18.783998+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2481695"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in LangChain, a framework for building agents and large language model (LLM)-powered applications. Older runtime code paths within LangChain deserialize application-controlled payloads using overly broad object allowlists. A remote attacker can exploit this by supplying specially crafted LangChain serialized constructor dictionaries, leading to the instantiation of classes with untrusted arguments. This can result in the disclosure of sensitive information and potential partial compromise of data integrity.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "langchain: LangChain: Information disclosure and data integrity compromise via insecure deserialization",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important vulnerability in LangChain allows a remote attacker to achieve information disclosure and partial data integrity compromise. The flaw arises from overly broad object allowlists in older runtime code paths, which can deserialize attacker-controlled payloads and instantiate classes with untrusted arguments. Red Hat products integrating LangChain are affected if they process untrusted structured input and utilize deprecated APIs such as RunnableWithMessageHistory, astream_log(), or astream_events(version=\"v1\"), potentially leading to prompt injection or sensitive data exposure.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44843"
},
{
"category": "external",
"summary": "RHBZ#2481695",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481695"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44843",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44843"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44843",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44843"
},
{
"category": "external",
"summary": "https://github.com/langchain-ai/langchain/security/advisories/GHSA-pjwx-r37v-7724",
"url": "https://github.com/langchain-ai/langchain/security/advisories/GHSA-pjwx-r37v-7724"
}
],
"release_date": "2026-05-26T19:47:35.328000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:10:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43038"
},
{
"category": "workaround",
"details": "To mitigate this issue, applications using LangChain should avoid passing untrusted structured input directly to load() or loads() functions. Instead, ensure all incoming untrusted data is validated and canonicalized into an inert schema before being processed by LangChain. Additionally, migrate away from deprecated LangChain APIs, including RunnableWithMessageHistory, astream_log(), and astream_events(version=\"v1\"), as these older code paths are more susceptible to insecure deserialization.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "langchain: LangChain: Information disclosure and data integrity compromise via insecure deserialization"
},
{
"cve": "CVE-2026-45292",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-05-28T17:02:14.674828+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2482785"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in OpenTelemetry Java, specifically within the baggage propagation implementation of opentelemetry-api and opentelemetry-extension-trace-propagators. A remote attacker can exploit this vulnerability by sending oversized baggage, which leads to unbounded memory allocation and high CPU consumption. This can result in a Denial of Service (DoS) for the affected service. Furthermore, because baggage is automatically re-injected into outgoing requests, the impact can spread to other downstream services.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "opentelemetry-java: opentelemetry-api: opentelemetry-extension-trace-propagators: OpenTelemetry Java: Denial of Service due to unbounded memory allocation when parsing oversized baggage",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in OpenTelemetry Java\u0027s baggage propagation, affecting Red Hat products that use OpenTelemetry for telemetry. A remote attacker can exploit this by sending excessively large baggage, leading to uncontrolled memory and CPU usage. The vulnerability\u0027s impact can extend to downstream services due to automatic re-injection of baggage into outgoing requests.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-45292"
},
{
"category": "external",
"summary": "RHBZ#2482785",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482785"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-45292",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45292"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-45292",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45292"
},
{
"category": "external",
"summary": "https://github.com/open-telemetry/opentelemetry-java/commit/03837d3c1763bc35464aea1078671e2ef2336a5f",
"url": "https://github.com/open-telemetry/opentelemetry-java/commit/03837d3c1763bc35464aea1078671e2ef2336a5f"
},
{
"category": "external",
"summary": "https://github.com/open-telemetry/opentelemetry-java/pull/8380",
"url": "https://github.com/open-telemetry/opentelemetry-java/pull/8380"
},
{
"category": "external",
"summary": "https://github.com/open-telemetry/opentelemetry-java/releases/tag/v1.62.0",
"url": "https://github.com/open-telemetry/opentelemetry-java/releases/tag/v1.62.0"
},
{
"category": "external",
"summary": "https://github.com/open-telemetry/opentelemetry-java/security/advisories/GHSA-rcgg-9c38-7xpx",
"url": "https://github.com/open-telemetry/opentelemetry-java/security/advisories/GHSA-rcgg-9c38-7xpx"
}
],
"release_date": "2026-05-28T16:37:29.490000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:10:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43038"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "opentelemetry-java: opentelemetry-api: opentelemetry-extension-trace-propagators: OpenTelemetry Java: Denial of Service due to unbounded memory allocation when parsing oversized baggage"
},
{
"cve": "CVE-2026-48526",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-05-28T16:01:22.805235+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2482734"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PyJWT, a Python library for JSON Web Token (JWT) implementation. When decoding JWTs, the library fails to validate the use of JSON Web Keys (JWK) in the HMAC algorithm while also supporting asymmetric algorithms. This allows a remote attacker to use the issuer\u0027s public key as the secret key for the HMAC algorithm, leading to the ability to forge JWTs. This vulnerability can result in authentication bypass or unauthorized access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important vulnerability in PyJWT allows for authentication bypass and unauthorized access. It occurs when a JWT verifier is misconfigured to accept both symmetric and asymmetric algorithms, and a public JSON Web Key is erroneously used as the HMAC secret. Red Hat products are only affected if they utilize this specific, non-standard verifier configuration.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-48526"
},
{
"category": "external",
"summary": "RHBZ#2482734",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482734"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-48526",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-48526"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48526",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48526"
},
{
"category": "external",
"summary": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx",
"url": "https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx"
}
],
"release_date": "2026-05-28T15:09:09.258000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:10:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43038"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens"
},
{
"cve": "CVE-2026-48710",
"cwe": {
"id": "CWE-1289",
"name": "Improper Validation of Unsafe Equivalence in Input"
},
"discovery_date": "2026-05-26T23:01:03.204374+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2481742"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Starlette, a lightweight ASGI (Asynchronous Server Gateway Interface) framework. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP `Host` request header. This malformed header could cause the `request.url` to be incorrectly reconstructed, leading to a discrepancy with the actual requested path. Consequently, security restrictions enforced by middleware and endpoints that rely on `request.url` for validation could be bypassed, potentially allowing unauthorized access or actions.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "starlette: Starlette: Security restriction bypass via malformed HTTP Host header",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The impact of this vulnerability is rated Moderate. A malformed Host header can manipulate the reconstructed request.url.path, introducing a discrepancy with the canonical ASGI request path (scope[\"path\"]). However, the vulnerability does not directly grant access, modify routing, or bypass security controls on its own. A path-based authentication or authorization bypass is possible only if an application depends on request.url.path for access control decisions rather than the canonical ASGI path or standard framework mechanisms. The impact relies heavily on downstream application design rather than a default library failure.\n\nRed Hat Satellite / Insights (IoP): The starlette package is included as a dependency of Connexion, but this flaw is rated Low impact because these services do not use path-based authentication middleware and all services are deployed behind reverse proxies. \n\nOpenShift Lightspeed (OLS): The starlette package is included as a dependency, but this flaw is rated Low impact because authentication is enforced via Kubernetes TokenReview/SubjectAccessReview through FastAPI dependency injection, not path-based middleware; request.url.path is only used for metrics and response header application.\n\nRHOAI Kubeflow Training images: starlette is being used as indirect dependency of mlflow, but this flaw is rated as Low impact because mlflow is used as client library only to store training metrics on remote server, it doesn\u0027t expose any endpoint.\n\nRHOAI odh-automl: The impact is reduced to Low since starlette is only used in the backend and it\u0027s transient dependency and starlette is not used at all to serve any endpoints.\n\nRHOAI odh-kserve-autogluon-server-rhel9: While the Starlette dependency is present in the build, the vulnerable code in starlette is not reachable. This reduces the impact to low.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-48710"
},
{
"category": "external",
"summary": "RHBZ#2481742",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481742"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-48710",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-48710"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48710",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48710"
},
{
"category": "external",
"summary": "https://badhost.org",
"url": "https://badhost.org"
},
{
"category": "external",
"summary": "https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6",
"url": "https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6"
},
{
"category": "external",
"summary": "https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr",
"url": "https://github.com/Kludex/starlette/security/advisories/GHSA-86qp-5c8j-p5mr"
},
{
"category": "external",
"summary": "https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-161.yaml",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/starlette/PYSEC-2026-161.yaml"
},
{
"category": "external",
"summary": "https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette",
"url": "https://ostif.org/disclosing-the-badhost-vulnerability-in-starlette"
},
{
"category": "external",
"summary": "https://www.secwest.net/starlette",
"url": "https://www.secwest.net/starlette"
},
{
"category": "external",
"summary": "https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette",
"url": "https://www.x41-dsec.de/lab/advisories/x41-2026-002-starlette"
}
],
"release_date": "2026-05-26T21:54:54.393000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:10:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43038"
},
{
"category": "workaround",
"details": "Deploying an RFC-compliant reverse proxy (such as nginx, Apache, HAProxy, or Caddy) in front of the ASGI server will reject malformed Host headers before they reach the application. This is the most straightforward mitigation that does not require code changes.\n\nIf custom middleware is present, it should be updated to use `request.scope[\"path\"]` instead of `request.url.path` for any security decisions. The ASGI scope path is derived from the HTTP request line and is not influenced by the Host header, so it reflects the actual request target.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "starlette: Starlette: Security restriction bypass via malformed HTTP Host header"
},
{
"cve": "CVE-2026-48746",
"cwe": {
"id": "CWE-501",
"name": "Trust Boundary Violation"
},
"discovery_date": "2026-06-22T23:00:57.824402+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2491581"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in vLLM, an inference and serving engine for large language models (LLMs). This vulnerability, residing in ASGI web servers and Starlette\u0027s trust in them, allows an attacker to bypass the OpenAI API Authentication Middleware. This bypass enables unauthorized access to the API without requiring the configured VLLM_API_KEY or --api-key, leading to critical unauthorized operations.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "vllm: starlette: vLLM: Critical authentication bypass allows unauthorized API access",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "CVE-2026-48746 is an authentication bypass in the vLLM OpenAI-compatible API server. A remote attacker who can reach the vLLM endpoint directly can craft a Host header so the authentication middleware checks a different URL path than the one actually dispatched, bypassing VLLM_API_KEY / --api-key protection. Successful exploitation allows unauthorized inference API access, which can result in confidentiality loss (model/prompt abuse) and availability impact (resource exhaustion). The flaw does not provide integrity compromise or arbitrary code execution. Exploitation requires vLLM API-key authentication to be enabled and the service to be exposed without an RFC-conforming reverse proxy that normalizes the Host header. Because Red Hat AI inference offerings are commonly deployed behind OpenShift Routes or similar proxies, and because the vulnerability is conditional on deployment and configuration, the overall flaw impact is rated Important rather than Critical.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-48746"
},
{
"category": "external",
"summary": "RHBZ#2491581",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491581"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-48746",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-48746"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48746",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48746"
},
{
"category": "external",
"summary": "https://github.com/vllm-project/vllm/pull/43426",
"url": "https://github.com/vllm-project/vllm/pull/43426"
},
{
"category": "external",
"summary": "https://github.com/vllm-project/vllm/security/advisories/GHSA-94f4-hr76-p5j6",
"url": "https://github.com/vllm-project/vllm/security/advisories/GHSA-94f4-hr76-p5j6"
},
{
"category": "external",
"summary": "https://x41-dsec.de/lab/advisories/x41-2026-002-starlette",
"url": "https://x41-dsec.de/lab/advisories/x41-2026-002-starlette"
}
],
"release_date": "2026-06-22T21:57:28.997000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:10:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43038"
},
{
"category": "workaround",
"details": "Restrict network access to the vLLM API endpoint to only trusted clients and internal networks. Implement firewall rules or network policies to limit inbound connections to the vLLM service, thereby reducing the attack surface. This operational control helps prevent unauthorized external access to the vulnerable API.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "vllm: starlette: vLLM: Critical authentication bypass allows unauthorized API access"
},
{
"cve": "CVE-2026-48990",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-06-17T22:00:51.839483+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2490168"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in joserfc, a Python library for JSON Object Signing and Encryption (JOSE). This vulnerability allows a remote attacker to cause resource exhaustion, leading to a Denial of Service (DoS), by sending oversized JSON Web Signature (JWS) payloads. The library fails to apply size limits, specifically JWSRegistry.max_payload_length, when processing RFC7797 b64=false JWS payloads.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "joserfc: joserfc: Resource exhaustion via oversized JSON Web Signature (JWS) payloads",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-48990"
},
{
"category": "external",
"summary": "RHBZ#2490168",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490168"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-48990",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-48990"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48990",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48990"
},
{
"category": "external",
"summary": "https://github.com/authlib/joserfc/releases/tag/1.6.7",
"url": "https://github.com/authlib/joserfc/releases/tag/1.6.7"
},
{
"category": "external",
"summary": "https://github.com/authlib/joserfc/security/advisories/GHSA-wphv-vfrh-23q5",
"url": "https://github.com/authlib/joserfc/security/advisories/GHSA-wphv-vfrh-23q5"
}
],
"release_date": "2026-06-17T21:08:10.534000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:10:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43038"
},
{
"category": "workaround",
"details": "The risk can be mitigated by rejecting oversized serialized JWS inputs before they reach joserfc and enforcing strict request/body size limits at the application or reverse-proxy layer.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "joserfc: joserfc: Resource exhaustion via oversized JSON Web Signature (JWS) payloads"
},
{
"cve": "CVE-2026-54283",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-06-22T18:01:06.194658+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2491440"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Starlette where the request.form() method silently ignores configured resource limits (max_fields and max_part_size) when parsing application/x-www-form-urlencoded data. An unauthenticated attacker can exploit this by sending a urlencoded request body with an arbitrarily large number of fields or an oversized field, causing denial of service through resource exhaustion.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "starlette: Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in Starlette where the request.form() method silently ignores configured resource limits (max_fields and max_part_size) when parsing application/x-www-form-urlencoded data. An unauthenticated attacker can exploit this by sending a urlencoded request body with an arbitrarily large number of fields or an oversized field, causing denial of service through resource exhaustion. This only affects applications that explicitly call request.form() on urlencoded input; JSON-only APIs and services where Starlette is a transitive dependency not used for form parsing are not affected.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54283"
},
{
"category": "external",
"summary": "RHBZ#2491440",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491440"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54283",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54283"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54283",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54283"
},
{
"category": "external",
"summary": "https://github.com/Kludex/starlette/security/advisories/GHSA-82w8-qh3p-5jfq",
"url": "https://github.com/Kludex/starlette/security/advisories/GHSA-82w8-qh3p-5jfq"
}
],
"release_date": "2026-06-22T16:46:16.706000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:10:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43038"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "starlette: Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS"
},
{
"cve": "CVE-2026-59939",
"cwe": {
"id": "CWE-409",
"name": "Improper Handling of Highly Compressed Data (Data Amplification)"
},
"discovery_date": "2026-07-08T20:02:11.756520+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2498212"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in httplib2, a Python HTTP client library. This vulnerability allows a malicious or compromised HTTP server to send a small compressed data payload that, when decompressed by httplib2, expands to an extremely large size in memory. This unbounded decompression can lead to a Denial of Service (DoS) by causing the client application to run out of memory and crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "httplib2: httplib2: Denial of Service via unbounded decompression of HTTP response bodies",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important vulnerability in `httplib2` allows a remote attacker to trigger a Denial of Service (DoS) in client applications. By sending a specially crafted, compressed HTTP response, a malicious server can cause the client to exhaust its memory due to unbounded decompression, leading to application crashes. This poses a significant risk to Red Hat products that use `httplib2` to process untrusted HTTP content.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"known_not_affected": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-59939"
},
{
"category": "external",
"summary": "RHBZ#2498212",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498212"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-59939",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-59939"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59939",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59939"
},
{
"category": "external",
"summary": "https://github.com/httplib2/httplib2/commit/87581ad6cf752fe3da2090c59058261d2d00a427",
"url": "https://github.com/httplib2/httplib2/commit/87581ad6cf752fe3da2090c59058261d2d00a427"
},
{
"category": "external",
"summary": "https://github.com/httplib2/httplib2/releases/tag/v0.32.0",
"url": "https://github.com/httplib2/httplib2/releases/tag/v0.32.0"
},
{
"category": "external",
"summary": "https://github.com/httplib2/httplib2/security/advisories/GHSA-j5g9-f88f-gfj3",
"url": "https://github.com/httplib2/httplib2/security/advisories/GHSA-j5g9-f88f-gfj3"
}
],
"release_date": "2026-07-08T19:34:05.150000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-21T22:10:10+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:43038"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:1e20ac649ee7fdcdad9930b1f0384e10c8794db9a2f211d4e3d1679c0c10cc53_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-analyzer-addon-rhel9@sha256:907c0c8c40c1fb494caa5feac439b90754160bf3f79d8e76cf2dded63f549db6_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:d466bf042711b13fc53cbc561b70e4f58cd77f8a05d1d4ee10c10a6e1c201fe7_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-cli-rhel9@sha256:ecae0c1053637d609a19773757c0ea8b336b645950a42473015daabfe9677fab_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:7377a2c2f16ca436819cbbf106fc27d3a8c44c7fca0a44108ccc826bf8678ace_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-discovery-addon-rhel9@sha256:a72cbf7b2ba6420e31ecca15f7d3628a671dd642a6ccf4610c5a26462a5d4b36_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:794180378ddb9a88001d76b849df305034924683a79ef145f744fe03bee9c32b_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-dotnet-external-provider-rhel9@sha256:b5d66f8d4c6d6680886e631296c927c9502817fbb823a680f1dabf1cc92e0465_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8e5ba3659ef5f88b81c1c9d795b6af6048fd7d870493ce5f013efcb9fce90b9d_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-go-external-provider-rhel9@sha256:8f91d460985e1a97ac6892d26c0517f39871d94d1b3bfad005d58d424bed2b0b_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:0223927b9e584f302aabafdbf015a779b14c9b5816cf0baa0cb1bfe0b1cc3415_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-hub-rhel9@sha256:2e251b0343327f2ac6e60d2888da526be6a82a355310f1aea93011426cddc485_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:60c4a45085db3517f6a9bae32a4b93fd2dfa799c3e957776ad2d8ab0777507c2_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-java-external-provider-rhel9@sha256:e8bd699e851fbab4466d1d25e3a08e2bcf8997978cb7f19f509c627be42d03dd_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:12883516af95bf0f6abad1556d22896f16a087c1e4191fedc1f5d689cf6d67f6_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-nodejs-external-provider-rhel9@sha256:a89c4d19ff39a406f3279b4ffd6f8d2a2a82a78ab3e9aa1dc0f2c385a24fa844_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-operator-bundle@sha256:94f88bf557a036c54b348c2689c699a720d5d347b1bba141feec273e624ccdbf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:647ca556be4338749fbe7cb18580466ce6155bfce17c96deda7b7c037fd16240_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-platform-addon-rhel9@sha256:f421044ff3d6911097aebcbabfac87ddad74987e0e5f18a96dd89454f46a4cdf_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:25618ee8a690f336e1604a1b1ca9dd5197bbdea5cd02cfaf588fbd950a8fd228_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-python-external-provider-rhel9@sha256:4f46867f5ff78e9e970bc572a1a625080ae8faea29dc098d3d7d4355e8350ca1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:3926f791376886972749cae0f8eb635af67a088811214066c6deb010c6b762f0_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-rhel9-operator@sha256:957a553608cbf9ed108c22f851ef809ed348cf592610851c3a554f3342ba511a_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:21fab4b77580795980fd60b24ab1d6a3cc159a9246beccd1c19938bca94edd23_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-solution-server-rhel9@sha256:f8c8651cc5fa016003ef4105f28775e0b225472d2c3135e5f37d1e1f748c515e_arm64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:a77f5a731c20943958b5f654bf3147b690d5dd608b794bff261a23dd89f785f1_amd64",
"Red Hat Migration Toolkit for Applications 8.2:registry.redhat.io/mta/mta-ui-rhel9@sha256:f59dcacb1eed9bcd539bc6c26a630115cf35378d77075247fb42219836e2adb7_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "httplib2: httplib2: Denial of Service via unbounded decompression of HTTP response bodies"
}
]
}
RHSA-2026:44481
Vulnerability from csaf_redhat - Published: 2026-07-23 13:13 - Updated: 2026-08-11 09:41Summary
Red Hat Security Advisory: Red Hat Update Infrastructure 5.2 security update
Severity
Important
Notes
Topic: The latest release of Red Hat Update Infrastructure. For more details, see the product documentation.
Details: Red Hat Update Infrastructure (RHUI) container images are based on the latest RHUI RPM packages and the ubi9 or ubi9-init base images.
This release updates to the latest version.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in the xmllint program distributed by the libxml2 package. A buffer over-read in the xmlHTMLPrintFileContext function in the xmllint.c file may be triggered when a crafted file is processed with the xmllint program using the `--htmlout` command line option, causing an application crash and resulting in a denial of service.
5.5 (Medium)
Affected products
Fixed
5 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Low
A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated buffer if a user runs a crafted command using the traditional key format. A malicious input could lead to a crash or leak sensitive data.
4.4 (Medium)
Affected products
Fixed
5 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in the interactive shell of the xmllint command-line tool, used for parsing XML files. When a user inputs an overly long command, the program does not check the input size properly, which can cause it to crash. This issue might allow attackers to run harmful code in rare configurations without modern protections.
CWE-121 - Stack-based Buffer OverflowAffected products
Fixed
5 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Low
A use-after-free vulnerability was found in libxslt while parsing xsl nodes that may lead to the dereference of expired pointers and application crash.
5.5 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64 | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64 | — | ||
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64 | — | ||
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64 | — | ||
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64 | — |
Threats
Impact
Moderate
A flaw was found in libtasn1. A remote attacker could exploit a stack-based buffer overflow vulnerability in the `asn1_expend_octet_string` function. This occurs due to a failure in validating the size of input data. Successful exploitation can lead to a Denial of Service (DoS) condition, making the affected system or application unavailable.
5.9 (Medium)
Affected products
Fixed
5 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Low
A flaw was found in glibc, the GNU C Library. Specifically, deprecated functions responsible for printing TSIG (Transaction Signature) records fail to properly manage memory buffers. This oversight can lead to an out-of-bounds write when processing specially crafted TSIG records. An attacker could exploit this to cause a denial of service or potentially execute arbitrary code.
5.9 (Medium)
Affected products
Fixed
5 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
A flaw was found in glibc (GNU C Library). This vulnerability occurs when an application uses the `scanf` family of functions with a `%mc` format specifier, which is used for dynamically allocating memory for character input, and provides an explicit width greater than 1024. This specific combination can lead to a one-byte heap buffer overflow, potentially allowing an attacker to corrupt memory.
5.0 (Medium)
Affected products
Fixed
5 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in glibc (GNU C Library). When the `ungetwc` function is called on a file stream using wide characters with specific overlapping single-byte and multi-byte encodings, it may attempt to read data outside of its allocated buffer. This can lead to the unintentional disclosure of sensitive information from memory or cause the program to crash, resulting in a denial of service.
5.0 (Medium)
Affected products
Fixed
5 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in glibc (GNU C Library). The deprecated functions ns_printrrf, ns_printrr, and fp_nquery do not properly validate the length of RDATA (Resource Record Data) in a DNS (Domain Name System) response when processing specific record types like LOC, CERT, TKEY, or TSIG. A remote attacker could craft a malicious DNS response, leading to a target application crashing or reading uninitialized memory. These functions are intended for application debugging and are not part of the standard DNS resolver path.
6.5 (Medium)
Affected products
Fixed
5 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
A flaw was found in PostgreSQL CREATE TYPE handling for multirange types. The database failed to properly verify schema CREATE privileges during multirange type creation. An authenticated database user could exploit this issue to hijack queries that rely on search_path resolution for user-defined or extension-defined types, potentially causing execution of arbitrary SQL functions within the affected database context.
5.4 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64 | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in PostgreSQL. An integer overflow in multiple server features allows an unprivileged database user to cause an undersized memory allocation that leads to an out-of-bounds write. This issue allows an attacker to execute arbitrary code as the operating system user running the database or, in applications that pass gigabyte-scale user inputs to the relevant database functions, to cause a segmentation fault, resulting in a denial of service.
8.8 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in PostgreSQL. This vulnerability, an externally-controlled format string in the `timeofday()` function, allows a remote attacker to craft specific timezone zones. Successful exploitation can lead to the retrieval of sensitive portions of server memory, potentially disclosing confidential information.
4.3 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64 | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in PostgreSQL. This vulnerability, related to symlink following in pg_basebackup (plain format) and pg_rewind, allows an origin superuser to overwrite local files. By exploiting this, an attacker could potentially hijack the operating system account. This attack has practical implications if specific actions are taken, such as moving files to a different virtual machine (VM) or snapshotting the VM, between the execution of these commands and the server's restart.
6.7 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64 | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64 | — | ||
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64 | — | ||
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64 | — | ||
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64 | — |
Threats
Impact
Moderate
A flaw was found in PostgreSQL libpq. A server superuser can exploit a buffer overflow vulnerability in the PQfn function, which is used by client functions such as lo_export(), lo_read(), lo_lseek64(), and lo_tell64(). This allows the superuser to send an arbitrarily large response, overwriting the client's stack memory, specifically in tools like psql and pg_dump. This could lead to arbitrary code execution on the client system.
8.4 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in PostgreSQL. This vulnerability, a covert timing channel, exists in the comparison of MD5-hashed passwords during authentication. A remote attacker could exploit this to recover user credentials, gaining unauthorized access to the database. This issue specifically impacts databases that retain MD5-hashed passwords from upgrades of PostgreSQL 13 or earlier.
8.2 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in PostgreSQL. Uncontrolled recursion during SSL (Secure Sockets Layer) and GSS (Generic Security Service) negotiation allows an attacker to achieve a sustained denial of service. This can be exploited by an attacker with access to a PostgreSQL AF_UNIX socket. If SSL and GSS are both disabled, the same denial of service can be achieved via a PostgreSQL TCP socket.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in PostgreSQL. A stack buffer overflow in the 'refint' module allows an unprivileged database user to execute arbitrary code as the operating system user running the database. Additionally, a separate vulnerability exists where, if an application uses a user-controlled column as a 'refint' cascade primary key and allows user-controlled updates, a SQL injection can enable an attacker to execute arbitrary SQL commands as the database user performing the update.
8.8 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64 | — |
Vendor Fix
fix
|
Known not affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64 | — | ||
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64 | — | ||
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64 | — | ||
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64 | — |
Threats
Impact
Important
A flaw was found in the ngx_http_rewrite_module module of NGINX. When a rewrite directive uses a regex pattern with distinct, overlapping Perl-Compatible Regular Expression (PCRE) captures and a replacement string that references multiple such captures in a redirect or arguments context, an unauthenticated attacker can send crafted HTTP requests and cause a heap-based buffer overflow in the worker process, potentially allowing code execution or a denial of service by forcing the process to restart.
8.1 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Python. Its incremental HTML parser can be exploited by a remote attacker. By sending specially crafted, uncontrolled data with repeated, incomplete markup declarations, the attacker can cause the system to consume excessive central processing unit (CPU) resources. This leads to a denial of service, making the affected system unresponsive.
7.5 (High)
Affected products
Fixed
5 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in openssl. Applications that use RSASVE key encapsulation, a method for securely exchanging encryption keys, may inadvertently expose sensitive data. This vulnerability arises when an application processes a malicious, invalid RSA public key provided by an attacker without proper validation. Consequently, the application might send the contents of an uninitialized memory buffer, which could contain confidential information, to the attacker.
5.9 (Medium)
Affected products
Fixed
5 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in Vim, an open-source command-line text editor. This command injection vulnerability occurs during tag file processing. A local user could craft a malicious tags file containing backtick syntax in the filename field. When Vim resolves a tag from this file, it executes the embedded command via the system shell, leading to arbitrary code execution with the privileges of the running user.
7.3 (High)
Affected products
Fixed
5 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in NGINX. When NGINX is configured to proxy HTTP/2 traffic using the ngx_http_proxy_v2_module or ngx_http_grpc_module with specific settings, a remote, unauthenticated attacker can send specially crafted large headers. This can trigger a heap-based buffer overflow, leading to a restart of the NGINX worker process and a Denial of Service (DoS). Under certain conditions, such as when Address Space Layout Randomization (ASLR) is disabled or bypassed, this vulnerability could also allow for arbitrary code execution.
8.1 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in urllib3, an HTTP client library for Python. When using the low-level API via `ProxyManager.connection_from_url().urlopen()` with `assert_same_host=False`, cross-origin redirects can still forward sensitive headers. This could allow a remote attacker to gain unauthorized access to sensitive information.
5.9 (Medium)
Affected products
Fixed
5 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
A flaw was found in urllib3, an HTTP client library for Python. This vulnerability allows a remote attacker to cause excessive resource consumption, such as high CPU usage and massive memory allocation, on the client side. This occurs when urllib3 attempts to decompress an entire HTTP response, even if only a partial read was requested, or when draining the connection after a partial decompression. This can lead to a Denial of Service (DoS) condition.
7.5 (High)
Affected products
Fixed
5 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64 | — |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in libsolv. This heap buffer overflow occurs during the decompression of attacker-controlled compressed data within `.solv` files due to insufficient input validation. An attacker can provide a specially crafted `.solv` file, which, when processed by a vulnerable application, can lead to out-of-bounds memory access. This could result in information disclosure, alteration of program execution, or a denial of service.
7.8 (High)
Affected products
Fixed
5 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in the `acl` package, specifically within its `libacl` pathname-based functions. A local attacker could exploit this vulnerability by using a symbolic link to replace a pathname component. This could allow the attacker to redirect access control list (ACL) read or write operations to arbitrary files or directories, leading to unauthorized manipulation of ACLs and ultimately local privilege escalation.
7.1 (High)
Affected products
Fixed
5 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A time-of-check to time-of-use (TOCTOU) race condition vulnerability was found in `acl`. By replacing a pathname component with a symbolic link between a security check and subsequent file operations, an attacker can redirect file access control list operations. This occurs when privileged processes invoke `getfacl` or `setfacl` over an attacker-controlled path, potentially leading to local privilege escalation.
6.3 (Medium)
Affected products
Fixed
5 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
A flaw was found in GLib. A state confusion issue exists in g_dbus_node_info_new_for_xml() in the gio/gdbusintrospection.c file when processing malformed D-Bus introspection XML, specifically with a `node` element nested within other elements like `method`, `signal`, `property` or `arg`. This issue can cause an unsigned integer overflow and lead to an out-of-bounds read, resulting in a denial of service.
7.5 (High)
Affected products
Fixed
5 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
References
184 references
Acknowledgments
Mohamed Maatallah
Ahmed Lekssays
Andrew Tridgell <tridge60@gmail.com>
Alexander Peslyak <solar@openwall.com>
linhlhq
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "The latest release of Red Hat Update Infrastructure. For more details, see the product documentation.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat Update Infrastructure (RHUI) container images are based on the latest RHUI RPM packages and the ubi9 or ubi9-init base images.\nThis release updates to the latest version.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:44481",
"url": "https://access.redhat.com/errata/RHSA-2026:44481"
},
{
"category": "external",
"summary": "https://access.redhat.com/products/red-hat-update-infrastructure",
"url": "https://access.redhat.com/products/red-hat-update-infrastructure"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2024-34459",
"url": "https://access.redhat.com/security/cve/CVE-2024-34459"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-10911",
"url": "https://access.redhat.com/security/cve/CVE-2025-10911"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-13151",
"url": "https://access.redhat.com/security/cve/CVE-2025-13151"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-5278",
"url": "https://access.redhat.com/security/cve/CVE-2025-5278"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-6170",
"url": "https://access.redhat.com/security/cve/CVE-2025-6170"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-15308",
"url": "https://access.redhat.com/security/cve/CVE-2026-15308"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-31790",
"url": "https://access.redhat.com/security/cve/CVE-2026-31790"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41411",
"url": "https://access.redhat.com/security/cve/CVE-2026-41411"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42055",
"url": "https://access.redhat.com/security/cve/CVE-2026-42055"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-44431",
"url": "https://access.redhat.com/security/cve/CVE-2026-44431"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-44432",
"url": "https://access.redhat.com/security/cve/CVE-2026-44432"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-48864",
"url": "https://access.redhat.com/security/cve/CVE-2026-48864"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-5435",
"url": "https://access.redhat.com/security/cve/CVE-2026-5435"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54369",
"url": "https://access.redhat.com/security/cve/CVE-2026-54369"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54370",
"url": "https://access.redhat.com/security/cve/CVE-2026-54370"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-5450",
"url": "https://access.redhat.com/security/cve/CVE-2026-5450"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-58016",
"url": "https://access.redhat.com/security/cve/CVE-2026-58016"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-5928",
"url": "https://access.redhat.com/security/cve/CVE-2026-5928"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-6238",
"url": "https://access.redhat.com/security/cve/CVE-2026-6238"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-6472",
"url": "https://access.redhat.com/security/cve/CVE-2026-6472"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-6473",
"url": "https://access.redhat.com/security/cve/CVE-2026-6473"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-6474",
"url": "https://access.redhat.com/security/cve/CVE-2026-6474"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-6475",
"url": "https://access.redhat.com/security/cve/CVE-2026-6475"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-6477",
"url": "https://access.redhat.com/security/cve/CVE-2026-6477"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-6478",
"url": "https://access.redhat.com/security/cve/CVE-2026-6478"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-6479",
"url": "https://access.redhat.com/security/cve/CVE-2026-6479"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-6637",
"url": "https://access.redhat.com/security/cve/CVE-2026-6637"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-9256",
"url": "https://access.redhat.com/security/cve/CVE-2026-9256"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/red_hat_update_infrastructure/5",
"url": "https://docs.redhat.com/en/documentation/red_hat_update_infrastructure/5"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_44481.json"
}
],
"title": "Red Hat Security Advisory: Red Hat Update Infrastructure 5.2 security update",
"tracking": {
"current_release_date": "2026-08-11T09:41:02+00:00",
"generator": {
"date": "2026-08-11T09:41:02+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.14"
}
},
"id": "RHSA-2026:44481",
"initial_release_date": "2026-07-23T13:13:25+00:00",
"revision_history": [
{
"date": "2026-07-23T13:13:25+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-08-08T04:36:23+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-11T09:41:02+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Update Infrastructure 5",
"product": {
"name": "Red Hat Update Infrastructure 5",
"product_id": "Red Hat Update Infrastructure 5",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhui:5::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat Update Infrastructure"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"product": {
"name": "registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"product_id": "registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"product_identification_helper": {
"purl": "pkg:oci/cds-kubernetes-rhel9@sha256%3A434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02?arch=amd64\u0026repository_url=registry.redhat.io/rhui5/cds-kubernetes-rhel9\u0026tag=1784794818"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"product": {
"name": "registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"product_id": "registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"product_identification_helper": {
"purl": "pkg:oci/cds-rhel9@sha256%3A2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8?arch=amd64\u0026repository_url=registry.redhat.io/rhui5/cds-rhel9\u0026tag=1784794778"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"product": {
"name": "registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"product_id": "registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"product_identification_helper": {
"purl": "pkg:oci/haproxy-rhel9@sha256%3Aeaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a?arch=amd64\u0026repository_url=registry.redhat.io/rhui5/haproxy-rhel9\u0026tag=1784795112"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"product": {
"name": "registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"product_id": "registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"product_identification_helper": {
"purl": "pkg:oci/installer-rhel9@sha256%3A18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a?arch=amd64\u0026repository_url=registry.redhat.io/rhui5/installer-rhel9\u0026tag=1784794289"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64",
"product": {
"name": "registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64",
"product_id": "registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64",
"product_identification_helper": {
"purl": "pkg:oci/rhua-rhel9@sha256%3A81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da?arch=amd64\u0026repository_url=registry.redhat.io/rhui5/rhua-rhel9\u0026tag=1784795076"
}
}
}
],
"category": "architecture",
"name": "amd64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64 as a component of Red Hat Update Infrastructure 5",
"product_id": "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64"
},
"product_reference": "registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"relates_to_product_reference": "Red Hat Update Infrastructure 5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64 as a component of Red Hat Update Infrastructure 5",
"product_id": "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64"
},
"product_reference": "registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"relates_to_product_reference": "Red Hat Update Infrastructure 5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64 as a component of Red Hat Update Infrastructure 5",
"product_id": "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64"
},
"product_reference": "registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"relates_to_product_reference": "Red Hat Update Infrastructure 5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64 as a component of Red Hat Update Infrastructure 5",
"product_id": "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64"
},
"product_reference": "registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"relates_to_product_reference": "Red Hat Update Infrastructure 5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64 as a component of Red Hat Update Infrastructure 5",
"product_id": "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
},
"product_reference": "registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64",
"relates_to_product_reference": "Red Hat Update Infrastructure 5"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-34459",
"cwe": {
"id": "CWE-126",
"name": "Buffer Over-read"
},
"discovery_date": "2024-05-14T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2280532"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the xmllint program distributed by the libxml2 package. A buffer over-read in the xmlHTMLPrintFileContext function in the xmllint.c file may be triggered when a crafted file is processed with the xmllint program using the `--htmlout` command line option, causing an application crash and resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxml2: buffer over-read in xmlHTMLPrintFileContext in xmllint.c",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue only affects the xmllint program when the `--htmlout\u0027 command line option is used. Additionally, an application is not vulnerable if it does not use or expose the xmllint program.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2024-34459"
},
{
"category": "external",
"summary": "RHBZ#2280532",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2280532"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2024-34459",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-34459"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-34459",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34459"
},
{
"category": "external",
"summary": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/720",
"url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/720"
}
],
"release_date": "2024-05-08T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-23T13:13:25+00:00",
"details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
"product_ids": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:44481"
},
{
"category": "workaround",
"details": "Do not process untrusted files with the xmllint program.",
"product_ids": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "libxml2: buffer over-read in xmlHTMLPrintFileContext in xmllint.c"
},
{
"acknowledgments": [
{
"names": [
"Mohamed Maatallah"
]
}
],
"cve": "CVE-2025-5278",
"cwe": {
"id": "CWE-121",
"name": "Stack-based Buffer Overflow"
},
"discovery_date": "2025-05-27T13:50:20.148000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2368764"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in GNU Coreutils. The sort utility\u0027s begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated buffer if a user runs a crafted command using the traditional key format. A malicious input could lead to a crash or leak sensitive data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "coreutils: Heap Buffer Under-Read in GNU Coreutils sort via Key Specification",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The severity of this issue is considered Moderate rather than Critical because successful exploitation requires the use of the traditional key specification syntax with an exceptionally large character position value, which is uncommon in typical usage. Although the vulnerability can lead to a heap buffer overflow resulting in a read one byte before the allocated buffer, it does not enable code execution, privilege escalation, or direct compromise of data confidentiality or integrity. The impact is therefore primarily limited to potential service disruption due to application crashes.\n\nFurthermore, default RHEL configurations such as SELinux enforcement, ASLR, and memory protections reduce the likelihood of exploitation and limit the scope of any resulting impact. These safeguards, along with typical system usage patterns that do not commonly invoke the vulnerable code path, restrict exploitability in default and hardened environments. Consequently, the vulnerability\u2019s overall security impact is mitigated compared to flaws that allow immediate code execution or broader compromise across system components.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-5278"
},
{
"category": "external",
"summary": "RHBZ#2368764",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2368764"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-5278",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-5278"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-5278",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5278"
},
{
"category": "external",
"summary": "https://cgit.git.savannah.gnu.org/cgit/coreutils.git/commit/?id=8c9602e3a145e9596dc1a63c6ed67865814b6633",
"url": "https://cgit.git.savannah.gnu.org/cgit/coreutils.git/commit/?id=8c9602e3a145e9596dc1a63c6ed67865814b6633"
},
{
"category": "external",
"summary": "https://debbugs.gnu.org/cgi/bugreport.cgi?bug=78507",
"url": "https://debbugs.gnu.org/cgi/bugreport.cgi?bug=78507"
}
],
"release_date": "2025-05-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-23T13:13:25+00:00",
"details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
"product_ids": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:44481"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L",
"version": "3.1"
},
"products": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "coreutils: Heap Buffer Under-Read in GNU Coreutils sort via Key Specification"
},
{
"acknowledgments": [
{
"names": [
"Ahmed Lekssays"
]
}
],
"cve": "CVE-2025-6170",
"cwe": {
"id": "CWE-121",
"name": "Stack-based Buffer Overflow"
},
"discovery_date": "2025-06-16T05:33:22.955000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2372952"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the interactive shell of the xmllint command-line tool, used for parsing XML files. When a user inputs an overly long command, the program does not check the input size properly, which can cause it to crash. This issue might allow attackers to run harmful code in rare configurations without modern protections.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxml2: Stack Buffer Overflow in xmllint Interactive Shell Command Handling",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Red Hat Product Security team has rated the severity of this vulnerability as Low, since it affects only the interactive shell mode of the xmllint tool and requires a user to manually run the tool and enter or receive specially crafted input. The exploitation requires local access and a highly specific usage scenario that is uncommon in typical environments. While it can cause a crash, the impact is limited to availability, and exploitation is unlikely in real-world deployments.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-6170"
},
{
"category": "external",
"summary": "RHBZ#2372952",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2372952"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-6170",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-6170"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-6170",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6170"
},
{
"category": "external",
"summary": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/941",
"url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/941"
}
],
"release_date": "2025-06-16T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-23T13:13:25+00:00",
"details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
"product_ids": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:44481"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to a widespread installation base, or stability. It is strongly recommended to apply the upstream patch once available.",
"product_ids": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 2.5,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "libxml2: Stack Buffer Overflow in xmllint Interactive Shell Command Handling"
},
{
"cve": "CVE-2025-10911",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2025-09-24T12:46:50.095000+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2397838"
}
],
"notes": [
{
"category": "description",
"text": "A use-after-free vulnerability was found in libxslt while parsing xsl nodes that may lead to the dereference of expired pointers and application crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxslt: use-after-free with key data stored cross-RVT",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
],
"known_not_affected": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-10911"
},
{
"category": "external",
"summary": "RHBZ#2397838",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2397838"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-10911",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-10911"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-10911",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10911"
},
{
"category": "external",
"summary": "https://gitlab.gnome.org/GNOME/libxslt/-/issues/144",
"url": "https://gitlab.gnome.org/GNOME/libxslt/-/issues/144"
},
{
"category": "external",
"summary": "https://gitlab.gnome.org/GNOME/libxslt/-/merge_requests/77",
"url": "https://gitlab.gnome.org/GNOME/libxslt/-/merge_requests/77"
}
],
"release_date": "2025-08-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-23T13:13:25+00:00",
"details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
"product_ids": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:44481"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libxslt: use-after-free with key data stored cross-RVT"
},
{
"cve": "CVE-2025-13151",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2026-01-07T22:01:02.206250+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2427698"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libtasn1. A remote attacker could exploit a stack-based buffer overflow vulnerability in the `asn1_expend_octet_string` function. This occurs due to a failure in validating the size of input data. Successful exploitation can lead to a Denial of Service (DoS) condition, making the affected system or application unavailable.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libtasn1: libtasn1: Denial of Service via stack-based buffer overflow in asn1_expend_octet_string",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Low for Red Hat products. A stack-based buffer overflow in the `libtasn1` library, specifically within the `asn1_expend_octet_string` function, can be triggered by failing to validate input data size. This could allow a remote, unauthenticated attacker to cause a denial of service in applications utilizing `libtasn1`.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-13151"
},
{
"category": "external",
"summary": "RHBZ#2427698",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2427698"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-13151",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-13151"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-13151",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13151"
},
{
"category": "external",
"summary": "https://gitlab.com/gnutls/libtasn1",
"url": "https://gitlab.com/gnutls/libtasn1"
},
{
"category": "external",
"summary": "https://gitlab.com/gnutls/libtasn1/-/merge_requests/121",
"url": "https://gitlab.com/gnutls/libtasn1/-/merge_requests/121"
}
],
"release_date": "2026-01-07T21:14:05.223000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-23T13:13:25+00:00",
"details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
"product_ids": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:44481"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "libtasn1: libtasn1: Denial of Service via stack-based buffer overflow in asn1_expend_octet_string"
},
{
"cve": "CVE-2026-5435",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2026-04-28T14:01:44.684432+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463465"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in glibc, the GNU C Library. Specifically, deprecated functions responsible for printing TSIG (Transaction Signature) records fail to properly manage memory buffers. This oversight can lead to an out-of-bounds write when processing specially crafted TSIG records. An attacker could exploit this to cause a denial of service or potentially execute arbitrary code.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "glibc: glibc: Out-of-bounds write via TSIG record processing",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-5435"
},
{
"category": "external",
"summary": "RHBZ#2463465",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463465"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-5435",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5435"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5435",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5435"
},
{
"category": "external",
"summary": "https://inbox.sourceware.org/libc-announce/7a655d55-276f-41fe-b550-feb3ebb2ce91@redhat.com/T/#u",
"url": "https://inbox.sourceware.org/libc-announce/7a655d55-276f-41fe-b550-feb3ebb2ce91@redhat.com/T/#u"
},
{
"category": "external",
"summary": "https://sourceware.org/bugzilla/show_bug.cgi?id=34033",
"url": "https://sourceware.org/bugzilla/show_bug.cgi?id=34033"
}
],
"release_date": "2026-04-28T11:58:54.962000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-23T13:13:25+00:00",
"details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
"product_ids": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:44481"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "glibc: glibc: Out-of-bounds write via TSIG record processing"
},
{
"cve": "CVE-2026-5450",
"cwe": {
"id": "CWE-131",
"name": "Incorrect Calculation of Buffer Size"
},
"discovery_date": "2026-04-20T21:01:35.403778+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2459853"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in glibc (GNU C Library). This vulnerability occurs when an application uses the `scanf` family of functions with a `%mc` format specifier, which is used for dynamically allocating memory for character input, and provides an explicit width greater than 1024. This specific combination can lead to a one-byte heap buffer overflow, potentially allowing an attacker to corrupt memory.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "glibc: glibc: Heap Buffer Overflow in `scanf` with `%mc` format specifier and large width",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Because this flaw requires that an affected application call the affected functions with an attacker-supplied value, Red Hat assesses the Attack Complexity of this flaw as High. Additionally, the flaw overflows a single byte onto the heap, so meaningful exploitation requires that the heap is structured such that a single byte can lead to an attacker-controlled outcome, or that the affected functions can be invoked with an attacker-controlled buffer base address. Regarding Attack Vector and Privileges Required, Red Hat assesses these elements as Local and Low respectively, as remote unauthenticated exploitation would require all the conditions above in a library client that listened on a network port and processed attacker-controllable data with the affected library functions.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-5450"
},
{
"category": "external",
"summary": "RHBZ#2459853",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2459853"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-5450",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5450"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5450",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5450"
},
{
"category": "external",
"summary": "https://inbox.sourceware.org/libc-announce/b11f0003-6ec1-4bd6-b9de-9e38a4efeca3@redhat.com/T/#u",
"url": "https://inbox.sourceware.org/libc-announce/b11f0003-6ec1-4bd6-b9de-9e38a4efeca3@redhat.com/T/#u"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5450#range-21286997",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5450#range-21286997"
},
{
"category": "external",
"summary": "https://sourceware.org/bugzilla/show_bug.cgi?id=CVE-2026-5450",
"url": "https://sourceware.org/bugzilla/show_bug.cgi?id=CVE-2026-5450"
}
],
"release_date": "2026-04-20T20:55:41.170000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-23T13:13:25+00:00",
"details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
"product_ids": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:44481"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.0,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"products": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "glibc: glibc: Heap Buffer Overflow in `scanf` with `%mc` format specifier and large width"
},
{
"cve": "CVE-2026-5928",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2026-04-20T21:01:38.811304+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2459854"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in glibc (GNU C Library). When the `ungetwc` function is called on a file stream using wide characters with specific overlapping single-byte and multi-byte encodings, it may attempt to read data outside of its allocated buffer. This can lead to the unintentional disclosure of sensitive information from memory or cause the program to crash, resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "glibc: glibc: Information disclosure or denial of service via ungetwc function with specific wide character encodings",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-5928"
},
{
"category": "external",
"summary": "RHBZ#2459854",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2459854"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-5928",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5928"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5928",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5928"
},
{
"category": "external",
"summary": "https://sourceware.org/bugzilla/show_bug.cgi?id=33998",
"url": "https://sourceware.org/bugzilla/show_bug.cgi?id=33998"
}
],
"release_date": "2026-04-20T20:37:31.743000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-23T13:13:25+00:00",
"details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
"product_ids": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:44481"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.0,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "glibc: glibc: Information disclosure or denial of service via ungetwc function with specific wide character encodings"
},
{
"cve": "CVE-2026-6238",
"cwe": {
"id": "CWE-1284",
"name": "Improper Validation of Specified Quantity in Input"
},
"discovery_date": "2026-04-28T19:09:30.721026+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463539"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in glibc (GNU C Library). The deprecated functions ns_printrrf, ns_printrr, and fp_nquery do not properly validate the length of RDATA (Resource Record Data) in a DNS (Domain Name System) response when processing specific record types like LOC, CERT, TKEY, or TSIG. A remote attacker could craft a malicious DNS response, leading to a target application crashing or reading uninitialized memory. These functions are intended for application debugging and are not part of the standard DNS resolver path.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "glibc: glibc: Application crash or uninitialized memory read via crafted DNS response",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-6238"
},
{
"category": "external",
"summary": "RHBZ#2463539",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463539"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-6238",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-6238"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-6238",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6238"
},
{
"category": "external",
"summary": "https://inbox.sourceware.org/libc-announce/7a655d55-276f-41fe-b550-feb3ebb2ce91@redhat.com/T/#u",
"url": "https://inbox.sourceware.org/libc-announce/7a655d55-276f-41fe-b550-feb3ebb2ce91@redhat.com/T/#u"
},
{
"category": "external",
"summary": "https://sourceware.org/bugzilla/show_bug.cgi?id=34069",
"url": "https://sourceware.org/bugzilla/show_bug.cgi?id=34069"
}
],
"release_date": "2026-04-28T16:43:08.526000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-23T13:13:25+00:00",
"details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
"product_ids": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:44481"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "glibc: glibc: Application crash or uninitialized memory read via crafted DNS response"
},
{
"cve": "CVE-2026-6472",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"discovery_date": "2026-05-14T14:01:10.230544+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477436"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PostgreSQL CREATE TYPE handling for multirange types. The database failed to properly verify schema CREATE privileges during multirange type creation. An authenticated database user could exploit this issue to hijack queries that rely on search_path resolution for user-defined or extension-defined types, potentially causing execution of arbitrary SQL functions within the affected database context.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "postgresql: PostgreSQL CREATE TYPE does not check multirange schema CREATE privilege",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability affects PostgreSQL multirange type creation functionality. Red Hat Product Security has assessed this issue as a Moderate severity vulnerability.\n\nThe vulnerability does not directly provide operating system command execution or PostgreSQL superuser privileges. The impact is limited to the affected database context and depends on application query behavior and schema resolution patterns. Therefore, Red Hat assessed the Confidentiality and Integrity impacts as Low (C:L/I:L), with no demonstrated Availability impact (A:N).",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
],
"known_not_affected": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-6472"
},
{
"category": "external",
"summary": "RHBZ#2477436",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477436"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-6472",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-6472"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-6472",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6472"
},
{
"category": "external",
"summary": "https://www.postgresql.org/support/security/CVE-2026-6472/",
"url": "https://www.postgresql.org/support/security/CVE-2026-6472/"
}
],
"release_date": "2026-05-14T13:00:02.086000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-23T13:13:25+00:00",
"details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
"product_ids": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:44481"
},
{
"category": "workaround",
"details": "Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security\u0027s standards for usability, deployment, applicability, or stability.",
"product_ids": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "postgresql: PostgreSQL CREATE TYPE does not check multirange schema CREATE privilege"
},
{
"cve": "CVE-2026-6473",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"discovery_date": "2026-05-14T14:01:48.197406+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477448"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PostgreSQL. An integer overflow in multiple server features allows an unprivileged database user to cause an undersized memory allocation that leads to an out-of-bounds write. This issue allows an attacker to execute arbitrary code as the operating system user running the database or, in applications that pass gigabyte-scale user inputs to the relevant database functions, to cause a segmentation fault, resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "postgresql: integer overflow can cause an undersized allocation and an out-of-bounds write",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker with minimal access to a database needs to pass extremely large inputs to vulnerable database functions, causing an integer overflow that leads to an out-of-bounds write. This flaw allows an attacker to potentially execute arbitrary code or, more likely, cause a denial of service.\n\nDefault Red Hat Enterprise Linux security features, including SELinux enforcement, Address Space Layout Randomization (ASLR) and NX (No-Execute) stack protection, significantly increase the difficulty of achieving arbitrary code execution, limiting the impact of this vulnerability.\n\nDue to these reasons, this vulnerability has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
],
"known_not_affected": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-6473"
},
{
"category": "external",
"summary": "RHBZ#2477448",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477448"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-6473",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-6473"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-6473",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6473"
},
{
"category": "external",
"summary": "https://www.postgresql.org/support/security/CVE-2026-6473/",
"url": "https://www.postgresql.org/support/security/CVE-2026-6473/"
}
],
"release_date": "2026-05-14T13:00:09.446000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-23T13:13:25+00:00",
"details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
"product_ids": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:44481"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, validate the length of data and the size of objects on all client APIs and web interfaces. Also, block, drop, or truncate oversized string, array, or binary objects before they are passed into backend SQL queries.",
"product_ids": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "postgresql: integer overflow can cause an undersized allocation and an out-of-bounds write"
},
{
"cve": "CVE-2026-6474",
"cwe": {
"id": "CWE-134",
"name": "Use of Externally-Controlled Format String"
},
"discovery_date": "2026-05-14T14:01:28.018770+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477441"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PostgreSQL. This vulnerability, an externally-controlled format string in the `timeofday()` function, allows a remote attacker to craft specific timezone zones. Successful exploitation can lead to the retrieval of sensitive portions of server memory, potentially disclosing confidential information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "postgresql: PostgreSQL: Information disclosure via externally-controlled format string in timeofday() function",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
],
"known_not_affected": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-6474"
},
{
"category": "external",
"summary": "RHBZ#2477441",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477441"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-6474",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-6474"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-6474",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6474"
},
{
"category": "external",
"summary": "https://www.postgresql.org/support/security/CVE-2026-6474/",
"url": "https://www.postgresql.org/support/security/CVE-2026-6474/"
}
],
"release_date": "2026-05-14T13:00:10.254000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-23T13:13:25+00:00",
"details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
"product_ids": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:44481"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "postgresql: PostgreSQL: Information disclosure via externally-controlled format string in timeofday() function"
},
{
"cve": "CVE-2026-6475",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"discovery_date": "2026-05-14T14:01:20.040061+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477439"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PostgreSQL. This vulnerability, related to symlink following in pg_basebackup (plain format) and pg_rewind, allows an origin superuser to overwrite local files. By exploiting this, an attacker could potentially hijack the operating system account. This attack has practical implications if specific actions are taken, such as moving files to a different virtual machine (VM) or snapshotting the VM, between the execution of these commands and the server\u0027s restart.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "postgresql: PostgreSQL: Operating system account hijack via symlink following in pg_basebackup and pg_rewind",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This MODERATE symlink following vulnerability in PostgreSQL\u0027s pg_basebackup and pg_rewind allows an origin superuser to overwrite local files. Exploitation requires local access, high privileges (superuser), and specific intermediate actions before server restart. Impact is high to confidentiality, integrity, and availability if exploited. Affects versions before 18.4, 17.10, 16.14, 15.18, and 14.23.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
],
"known_not_affected": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-6475"
},
{
"category": "external",
"summary": "RHBZ#2477439",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477439"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-6475",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-6475"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-6475",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6475"
},
{
"category": "external",
"summary": "https://www.postgresql.org/support/security/CVE-2026-6475/",
"url": "https://www.postgresql.org/support/security/CVE-2026-6475/"
}
],
"release_date": "2026-05-14T13:00:11.039000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-23T13:13:25+00:00",
"details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
"product_ids": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:44481"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "postgresql: PostgreSQL: Operating system account hijack via symlink following in pg_basebackup and pg_rewind"
},
{
"cve": "CVE-2026-6477",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2026-05-14T14:01:31.087667+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477442"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PostgreSQL libpq. A server superuser can exploit a buffer overflow vulnerability in the PQfn function, which is used by client functions such as lo_export(), lo_read(), lo_lseek64(), and lo_tell64(). This allows the superuser to send an arbitrarily large response, overwriting the client\u0027s stack memory, specifically in tools like psql and pg_dump. This could lead to arbitrary code execution on the client system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "postgresql: PostgreSQL libpq: Buffer overflow allows server superuser to overwrite client stack memory",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This IMPORTANT buffer overflow in PostgreSQL libpq allows a malicious server superuser to overwrite client stack memory via lo_* functions. Exploitation requires the victim to connect to a compromised or malicious server (UI:R). The scope is changed as the server attack affects the client system. Impact is high to confidentiality, integrity, and availability through potential client-side code execution. Affects versions before 18.4, 17.10, 16.14, 15.18, and 14.23.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
],
"known_not_affected": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-6477"
},
{
"category": "external",
"summary": "RHBZ#2477442",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477442"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-6477",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-6477"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-6477",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6477"
},
{
"category": "external",
"summary": "https://www.postgresql.org/support/security/CVE-2026-6477/",
"url": "https://www.postgresql.org/support/security/CVE-2026-6477/"
}
],
"release_date": "2026-05-14T13:00:12.497000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-23T13:13:25+00:00",
"details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
"product_ids": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:44481"
},
{
"category": "workaround",
"details": "Only connect to trusted PostgreSQL servers. Avoid using psql or pg_dump against untrusted or potentially compromised database servers.",
"product_ids": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "postgresql: PostgreSQL libpq: Buffer overflow allows server superuser to overwrite client stack memory"
},
{
"cve": "CVE-2026-6478",
"cwe": {
"id": "CWE-385",
"name": "Covert Timing Channel"
},
"discovery_date": "2026-05-14T14:01:45.568001+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477447"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PostgreSQL. This vulnerability, a covert timing channel, exists in the comparison of MD5-hashed passwords during authentication. A remote attacker could exploit this to recover user credentials, gaining unauthorized access to the database. This issue specifically impacts databases that retain MD5-hashed passwords from upgrades of PostgreSQL 13 or earlier.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "postgresql: PostgreSQL: Credential recovery via covert timing channel in MD5 password comparison",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
],
"known_not_affected": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-6478"
},
{
"category": "external",
"summary": "RHBZ#2477447",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477447"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-6478",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-6478"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-6478",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6478"
},
{
"category": "external",
"summary": "https://www.postgresql.org/support/security/CVE-2026-6478/",
"url": "https://www.postgresql.org/support/security/CVE-2026-6478/"
}
],
"release_date": "2026-05-14T13:00:13.174000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-23T13:13:25+00:00",
"details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
"product_ids": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:44481"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, ensure that all PostgreSQL user passwords are not hashed using MD5. Users should migrate to stronger hashing algorithms such as `scram-sha-256`. This can be achieved by altering user passwords, which will automatically update their hash to the currently configured default. For example, to change a user\u0027s password: `ALTER USER username WITH PASSWORD \u0027new_password\u0027;` This action will require users to re-authenticate. If a service relies on these credentials, it may require a restart to pick up the new authentication details.",
"product_ids": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "postgresql: PostgreSQL: Credential recovery via covert timing channel in MD5 password comparison"
},
{
"cve": "CVE-2026-6479",
"cwe": {
"id": "CWE-606",
"name": "Unchecked Input for Loop Condition"
},
"discovery_date": "2026-05-14T14:01:40.164297+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477445"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PostgreSQL. Uncontrolled recursion during SSL (Secure Sockets Layer) and GSS (Generic Security Service) negotiation allows an attacker to achieve a sustained denial of service. This can be exploited by an attacker with access to a PostgreSQL AF_UNIX socket. If SSL and GSS are both disabled, the same denial of service can be achieved via a PostgreSQL TCP socket.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "postgresql: PostgreSQL: Denial of Service via uncontrolled recursion in SSL/GSS negotiation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Uncontrolled recursion during PostgreSQL SSL and GSS negotiation allows an attacker able to connect to a PostgreSQL socket to trigger sustained CPU/stack exhaustion, resulting in denial of service. This affects the core connection-negotiation path, which runs unconditionally for every incoming connection attempt regardless of configuration \u2014 there is no optional feature or code path that must be enabled for exploitation, unlike some other recent flaws in this batch. Fix versions are 18.4, 17.10, 16.14, 15.18, and 14.23; PostgreSQL 12 and 13 branches are not listed as affected by upstream and do not contain the vulnerable recursion path. Affects were determined purely by comparing each shipped build\u0027s PostgreSQL version against these per-major-version fix thresholds.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
],
"known_not_affected": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-6479"
},
{
"category": "external",
"summary": "RHBZ#2477445",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477445"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-6479",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-6479"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-6479",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6479"
},
{
"category": "external",
"summary": "https://www.postgresql.org/support/security/CVE-2026-6479/",
"url": "https://www.postgresql.org/support/security/CVE-2026-6479/"
}
],
"release_date": "2026-05-14T13:00:13.859000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-23T13:13:25+00:00",
"details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
"product_ids": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:44481"
},
{
"category": "workaround",
"details": "Upgrade to PostgreSQL 18.4, 17.10, 16.14, 15.18, or 14.23 (matching your major version) or later. Restricting network/socket access to trusted clients reduces exposure but does not eliminate the vulnerability.",
"product_ids": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "postgresql: PostgreSQL: Denial of Service via uncontrolled recursion in SSL/GSS negotiation"
},
{
"cve": "CVE-2026-6637",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2026-05-14T14:01:33.754271+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477443"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PostgreSQL. A stack buffer overflow in the \u0027refint\u0027 module allows an unprivileged database user to execute arbitrary code as the operating system user running the database. Additionally, a separate vulnerability exists where, if an application uses a user-controlled column as a \u0027refint\u0027 cascade primary key and allows user-controlled updates, a SQL injection can enable an attacker to execute arbitrary SQL commands as the database user performing the update.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "postgresql: PostgreSQL: Arbitrary code execution vulnerability in \u0027refint\u0027 module",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
],
"known_not_affected": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-6637"
},
{
"category": "external",
"summary": "RHBZ#2477443",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477443"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-6637",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-6637"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-6637",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6637"
},
{
"category": "external",
"summary": "https://www.postgresql.org/support/security/CVE-2026-6637/",
"url": "https://www.postgresql.org/support/security/CVE-2026-6637/"
}
],
"release_date": "2026-05-14T13:00:15.223000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-23T13:13:25+00:00",
"details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
"product_ids": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:44481"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "postgresql: PostgreSQL: Arbitrary code execution vulnerability in \u0027refint\u0027 module"
},
{
"cve": "CVE-2026-9256",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2026-05-22T15:00:55.131994+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2480746"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the ngx_http_rewrite_module module of NGINX. When a rewrite directive uses a regex pattern with distinct, overlapping Perl-Compatible Regular Expression (PCRE) captures and a replacement string that references multiple such captures in a redirect or arguments context, an unauthenticated attacker can send crafted HTTP requests and cause a heap-based buffer overflow in the worker process, potentially allowing code execution or a denial of service by forcing the process to restart.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nginx: ngx_http_rewrite_module: code execution and denial of service",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this vulnerability, a rewrite directive must be configured with a regex pattern that uses distinct, overlapping PCRE captures and a replacement string referencing multiple such captures, limiting its exposure as this is not the default configuration. This issue allows an attacker to potentially execute arbitrary code or cause a denial of service by forcing the worker process to restart.\n\nDefault Red Hat Enterprise Linux security features, including SELinux enforcement, Address Space Layout Randomization (ASLR) and NX (No-Execute) stack protection, significantly increase the difficulty of achieving arbitrary code execution, limiting the impact of this vulnerability.\n\nDue to these reasons, this flaw has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
],
"known_not_affected": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-9256"
},
{
"category": "external",
"summary": "RHBZ#2480746",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480746"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-9256",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-9256"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-9256",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9256"
},
{
"category": "external",
"summary": "https://my.f5.com/manage/s/article/K000161377",
"url": "https://my.f5.com/manage/s/article/K000161377"
}
],
"release_date": "2026-05-22T14:11:41.877000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-23T13:13:25+00:00",
"details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
"product_ids": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:44481"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, use named captures instead of unnamed captures in rewrite definitions.\n\nFor example, the following rewrite directive uses unnamed PCRE capture groups, $1 and $2:\n\n~~~\nrewrite ^/users/([0-9]+)/profile/(.*)$ /profile.php?id=$1\u0026tab=$2 last;\n~~~\n\nTo mitigate this vulnerability for this example, replace $1 and $2 with the appropriate named captures, $user_id and $section:\n\n~~~\nrewrite ^/users/(?\u003cuser_id\u003e[0-9]+)/profile/(?\u003csection\u003e.*)$ /profile.php?id=$user_id\u0026tab=$section last;\n~~~",
"product_ids": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "nginx: ngx_http_rewrite_module: code execution and denial of service"
},
{
"cve": "CVE-2026-15308",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
},
"discovery_date": "2026-07-09T18:02:10.090070+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2498608"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Python. Its incremental HTML parser can be exploited by a remote attacker. By sending specially crafted, uncontrolled data with repeated, incomplete markup declarations, the attacker can cause the system to consume excessive central processing unit (CPU) resources. This leads to a denial of service, making the affected system unresponsive.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important vulnerability in Python\u0027s `html.parser.HTMLParser` can lead to a denial of service. By supplying specially crafted, malformed HTML with repeated unterminated markup declarations, an attacker can cause excessive CPU consumption, rendering the system unresponsive. Red Hat products utilizing this parser to process untrusted HTML content are susceptible to resource exhaustion.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-15308"
},
{
"category": "external",
"summary": "RHBZ#2498608",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498608"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-15308",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-15308"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-15308",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15308"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/commit/07efb08123ba9367a7107325adb9d5626dca1ca9",
"url": "https://github.com/python/cpython/commit/07efb08123ba9367a7107325adb9d5626dca1ca9"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/commit/7933f4bf7131aa4140750f9404f5de0aa2969ced",
"url": "https://github.com/python/cpython/commit/7933f4bf7131aa4140750f9404f5de0aa2969ced"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/commit/bcf98ddbc40ec9b3ee87da0124a5660b19b7e606",
"url": "https://github.com/python/cpython/commit/bcf98ddbc40ec9b3ee87da0124a5660b19b7e606"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/commit/e9f92ac0b298292e7ff998e52cb8ccacfb27a0bd",
"url": "https://github.com/python/cpython/commit/e9f92ac0b298292e7ff998e52cb8ccacfb27a0bd"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/issues/153030",
"url": "https://github.com/python/cpython/issues/153030"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/pull/153031",
"url": "https://github.com/python/cpython/pull/153031"
},
{
"category": "external",
"summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/F6453LWKSHKCTWFLCOURWPLETNUIW2Z5/",
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/F6453LWKSHKCTWFLCOURWPLETNUIW2Z5/"
}
],
"release_date": "2026-07-09T17:10:57.317000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-23T13:13:25+00:00",
"details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
"product_ids": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:44481"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations"
},
{
"cve": "CVE-2026-31790",
"cwe": {
"id": "CWE-824",
"name": "Access of Uninitialized Pointer"
},
"discovery_date": "2026-03-25T02:59:10.179000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451094"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in openssl. Applications that use RSASVE key encapsulation, a method for securely exchanging encryption keys, may inadvertently expose sensitive data. This vulnerability arises when an application processes a malicious, invalid RSA public key provided by an attacker without proper validation. Consequently, the application might send the contents of an uninitialized memory buffer, which could contain confidential information, to the attacker.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openssl: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Moderate impact. This flaw affects applications utilizing RSASVE key encapsulation, where an attacker-supplied invalid RSA public key is used with EVP_PKEY_encapsulate() without prior validation. This can lead to the disclosure of sensitive, uninitialized memory buffer contents to a malicious peer.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-31790"
},
{
"category": "external",
"summary": "RHBZ#2451094",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451094"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-31790",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31790"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-31790",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31790"
},
{
"category": "external",
"summary": "https://openssl-library.org/news/secadv/20260407.txt",
"url": "https://openssl-library.org/news/secadv/20260407.txt"
}
],
"release_date": "2026-04-07T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-23T13:13:25+00:00",
"details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
"product_ids": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:44481"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "openssl: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key"
},
{
"cve": "CVE-2026-41411",
"cwe": {
"id": "CWE-78",
"name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
},
"discovery_date": "2026-04-24T18:01:49.275019+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2461614"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Vim, an open-source command-line text editor. This command injection vulnerability occurs during tag file processing. A local user could craft a malicious tags file containing backtick syntax in the filename field. When Vim resolves a tag from this file, it executes the embedded command via the system shell, leading to arbitrary code execution with the privileges of the running user.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "vim: Vim: Command injection allows arbitrary code execution via malicious tag files",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41411"
},
{
"category": "external",
"summary": "RHBZ#2461614",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461614"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41411",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41411"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41411",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41411"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/commit/c78194e41d5a0b05b0ddf383b6679b1503f977fb",
"url": "https://github.com/vim/vim/commit/c78194e41d5a0b05b0ddf383b6679b1503f977fb"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/releases/tag/v9.2.0357",
"url": "https://github.com/vim/vim/releases/tag/v9.2.0357"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/security/advisories/GHSA-cwgx-gcj7-6qh8",
"url": "https://github.com/vim/vim/security/advisories/GHSA-cwgx-gcj7-6qh8"
}
],
"release_date": "2026-04-24T16:51:39.657000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-23T13:13:25+00:00",
"details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
"product_ids": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:44481"
},
{
"category": "workaround",
"details": "Mitigation for this issue involves exercising caution when opening or processing tag files from untrusted sources. Users should avoid loading tag files from unknown or suspicious origins to prevent the execution of arbitrary commands.",
"product_ids": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "vim: Vim: Command injection allows arbitrary code execution via malicious tag files"
},
{
"cve": "CVE-2026-42055",
"cwe": {
"id": "CWE-131",
"name": "Incorrect Calculation of Buffer Size"
},
"discovery_date": "2026-06-17T16:01:41.848723+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2489866"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in NGINX. When NGINX is configured to proxy HTTP/2 traffic using the ngx_http_proxy_v2_module or ngx_http_grpc_module with specific settings, a remote, unauthenticated attacker can send specially crafted large headers. This can trigger a heap-based buffer overflow, leading to a restart of the NGINX worker process and a Denial of Service (DoS). Under certain conditions, such as when Address Space Layout Randomization (ASLR) is disabled or bypassed, this vulnerability could also allow for arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nginx: NGINX: Arbitrary code execution or Denial of Service via heap-based buffer overflow with crafted HTTP/2 headers",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue is classified as Important severity primarily because:\nConditions for Exploitation: A remote, unauthenticated attacker can only exploit this if NGINX is explicitly configured to proxy HTTP/2 traffic using the ngx_http_proxy_v2_module or ngx_http_grpc_module.\n\nImpact Limitations: While the flaw reliably causes a Denial of Service (worker restart), achieving arbitrary code execution is highly complex in modern environments as it requires the attacker to bypass or disable Address Space Layout Randomization (ASLR)",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
],
"known_not_affected": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42055"
},
{
"category": "external",
"summary": "RHBZ#2489866",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2489866"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42055",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42055"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42055",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42055"
},
{
"category": "external",
"summary": "https://my.f5.com/manage/s/article/K000161584",
"url": "https://my.f5.com/manage/s/article/K000161584"
}
],
"release_date": "2026-06-17T14:04:32.520000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-23T13:13:25+00:00",
"details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
"product_ids": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:44481"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, ensure that the `ignore_invalid_headers` directive is set to `on` in your NGINX configuration, or reduce the size specified by the `large_client_header_buffers` directive to 2 megabytes or less. These changes require an NGINX service reload or restart to take effect. Reloading the NGINX service is generally safe, but a restart will briefly interrupt service.",
"product_ids": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "nginx: NGINX: Arbitrary code execution or Denial of Service via heap-based buffer overflow with crafted HTTP/2 headers"
},
{
"cve": "CVE-2026-44431",
"cwe": {
"id": "CWE-201",
"name": "Insertion of Sensitive Information Into Sent Data"
},
"discovery_date": "2026-05-13T17:01:41.663622+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477167"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in urllib3, an HTTP client library for Python. When using the low-level API via `ProxyManager.connection_from_url().urlopen()` with `assert_same_host=False`, cross-origin redirects can still forward sensitive headers. This could allow a remote attacker to gain unauthorized access to sensitive information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44431"
},
{
"category": "external",
"summary": "RHBZ#2477167",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477167"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44431",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44431"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44431",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44431"
},
{
"category": "external",
"summary": "https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc",
"url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc"
}
],
"release_date": "2026-05-13T15:20:24.588000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-23T13:13:25+00:00",
"details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
"product_ids": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:44481"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers"
},
{
"cve": "CVE-2026-44432",
"cwe": {
"id": "CWE-409",
"name": "Improper Handling of Highly Compressed Data (Data Amplification)"
},
"discovery_date": "2026-05-13T17:01:01.083841+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477154"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in urllib3, an HTTP client library for Python. This vulnerability allows a remote attacker to cause excessive resource consumption, such as high CPU usage and massive memory allocation, on the client side. This occurs when urllib3 attempts to decompress an entire HTTP response, even if only a partial read was requested, or when draining the connection after a partial decompression. This can lead to a Denial of Service (DoS) condition.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44432"
},
{
"category": "external",
"summary": "RHBZ#2477154",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477154"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44432",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44432"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44432",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44432"
},
{
"category": "external",
"summary": "https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j",
"url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j"
}
],
"release_date": "2026-05-13T15:17:12.611000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-23T13:13:25+00:00",
"details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
"product_ids": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:44481"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression"
},
{
"acknowledgments": [
{
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2026-48864",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-04-21T23:19:41+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2460425"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libsolv. This heap buffer overflow occurs during the decompression of attacker-controlled compressed data within `.solv` files due to insufficient input validation. An attacker can provide a specially crafted `.solv` file, which, when processed by a vulnerable application, can lead to out-of-bounds memory access. This could result in information disclosure, alteration of program execution, or a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libsolv: Heap buffer overflow in libsolv repopagestore via unchecked decompression of malicious .solv page data",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This heap buffer overflow in libsolv\u0027s page decompression logic can lead to out-of-bounds reads and writes when processing specially crafted `.solv` files. Exploitation requires a victim application to ingest malicious repository metadata, limiting the attack vector to scenarios involving user interaction or untrusted content sources. Given the user interaction needed, Red Hat Product Security has rated this vulnerability as having a impact of Moderate.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-48864"
},
{
"category": "external",
"summary": "RHBZ#2460425",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460425"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-48864",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-48864"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48864",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48864"
}
],
"release_date": "2026-05-26T16:07:55.363000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-23T13:13:25+00:00",
"details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
"product_ids": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:44481"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libsolv: Heap buffer overflow in libsolv repopagestore via unchecked decompression of malicious .solv page data"
},
{
"acknowledgments": [
{
"names": [
"Andrew Tridgell \u003ctridge60@gmail.com\u003e",
"Alexander Peslyak \u003csolar@openwall.com\u003e"
]
}
],
"cve": "CVE-2026-54369",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"discovery_date": "2026-06-16T23:47:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2490277"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `acl` package, specifically within its `libacl` pathname-based functions. A local attacker could exploit this vulnerability by using a symbolic link to replace a pathname component. This could allow the attacker to redirect access control list (ACL) read or write operations to arbitrary files or directories, leading to unauthorized manipulation of ACLs and ultimately local privilege escalation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "acl: Symlink traversal privilege escalation via libacl functions",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this flaw as Important because a local attacker who controls any component of a pathname processed by a privileged process using libacl can redirect ACL operations to arbitrary files. Exploitation requires local access with the ability to create symlinks in a directory that a privileged program later processes with acl_get_file() or acl_set_file(). In default RHEL and OpenShift CoreOS configurations, standard file permission settings limit where unprivileged users can create symlinks, reducing the practical attack surface. Programs that operate on user-supplied paths with elevated privileges are most at risk.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54369"
},
{
"category": "external",
"summary": "RHBZ#2490277",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490277"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54369",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54369"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54369",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54369"
}
],
"release_date": "2026-06-29T13:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-23T13:13:25+00:00",
"details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
"product_ids": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:44481"
},
{
"category": "workaround",
"details": "Restrict unprivileged users from creating symlinks in directories that privileged processes operate on with ACL commands. Where possible, use the fs.protected_symlinks sysctl (enabled by default on RHEL 7+), which prevents symlink following in world-writable sticky directories unless the owner of the symlink matches the owner of the target file or directory.",
"product_ids": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "acl: Symlink traversal privilege escalation via libacl functions"
},
{
"acknowledgments": [
{
"names": [
"Andrew Tridgell \u003ctridge60@gmail.com\u003e",
"Alexander Peslyak \u003csolar@openwall.com\u003e"
]
}
],
"cve": "CVE-2026-54370",
"cwe": {
"id": "CWE-367",
"name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
},
"discovery_date": "2026-06-16T19:47:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2490279"
}
],
"notes": [
{
"category": "description",
"text": "A time-of-check to time-of-use (TOCTOU) race condition vulnerability was found in `acl`. By replacing a pathname component with a symbolic link between a security check and subsequent file operations, an attacker can redirect file access control list operations. This occurs when privileged processes invoke `getfacl` or `setfacl` over an attacker-controlled path, potentially leading to local privilege escalation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "acl: TOCTOU Symlink Traversal via getfacl/setfacl",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54370"
},
{
"category": "external",
"summary": "RHBZ#2490279",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490279"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54370",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54370"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54370",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54370"
}
],
"release_date": "2026-06-29T13:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-23T13:13:25+00:00",
"details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
"product_ids": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:44481"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "acl: TOCTOU Symlink Traversal via getfacl/setfacl"
},
{
"acknowledgments": [
{
"names": [
"linhlhq"
]
}
],
"cve": "CVE-2026-58016",
"cwe": {
"id": "CWE-191",
"name": "Integer Underflow (Wrap or Wraparound)"
},
"discovery_date": "2026-06-24T17:29:08.344000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492257"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in GLib. A state confusion issue exists in g_dbus_node_info_new_for_xml() in the gio/gdbusintrospection.c file when processing malformed D-Bus introspection XML, specifically with a `node` element nested within other elements like `method`, `signal`, `property` or `arg`. This issue can cause an unsigned integer overflow and lead to an out-of-bounds read, resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "glib: integer underflow in gio/gdbusintrospection.c via \"g_dbus_node_info_new_for_xml\"",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Any applications processing D-Bus introspection XML input from untrusted sources with g_dbus_node_info_new_for_xml() are vulnerable to this issue. In GLib itself, the gdbus command line tool is the primary vector for local exploitation. However, other applications using the vulnerable function may process untrusted input in a way that allows a remote attacker to trigger this flaw. This vulnerability can cause an unsigned integer overflow and lead to an out-of-bounds read, resulting in a denial of service. As this vulnerability allows a remote attacker to cause a denial of service, it has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-58016"
},
{
"category": "external",
"summary": "RHBZ#2492257",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492257"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-58016",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58016"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-58016",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58016"
},
{
"category": "external",
"summary": "https://gitlab.gnome.org/GNOME/glib/-/issues/3932",
"url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3932"
}
],
"release_date": "2026-04-08T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-23T13:13:25+00:00",
"details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
"product_ids": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:44481"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, implement input validation to sanitize untrusted D-Bus introspection XML, specifically rejecting malformed structures such as \u003cnode\u003e elements improperly nested within \u003cmethod\u003e, \u003csignal\u003e, \u003cproperty\u003e or \u003carg\u003e elements before calling g_dbus_node_info_new_for_xml(). Alternatively, restricting the application to only process XML input from trusted, authenticated sources will completely neutralize this issue.",
"product_ids": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-kubernetes-rhel9@sha256:434630073ec81d616b326e2e33538a3b93ea1f6656ebce21538077ac92e1fc02_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:2d7cfa6b970738749ff50bf663c847294ff2db846a43d5afb90e85c02ba2f3a8_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:eaea46015abb1c75b880ec5ed07d4c897900011c0751bb2ce1f15ed293b5020a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:18804ea94a5f7f6741963313595575bd53cb5db11aef623c1ce6aa8a399d3f0a_amd64",
"Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:81f832ed93595aac1fb1e9dc9c7503b2e697316710f5d750d79f81596d8d31da_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "glib: integer underflow in gio/gdbusintrospection.c via \"g_dbus_node_info_new_for_xml\""
}
]
}
RHSA-2026:51206
Vulnerability from csaf_redhat - Published: 2026-08-06 17:41 - Updated: 2026-08-08 16:10Summary
Red Hat Security Advisory: General availability of the satellite/iop-advisor-backend-rhel9 container image
Severity
Important
Notes
Topic: A new satellite/iop-advisor-backend-rhel9 container image is now generally available in the Red Hat container registry.
Details: Red Hat Lightspeed in Satellite analyzes system health and configuration by applying predefined rules to a small set of local data, such as installed packages, running services, and configuration settings. When you install Red Hat Lightspeed in Satellite locally, you can generate Red Hat Lightspeed recommendations without sending system data to Red Hat services.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in urllib3, an HTTP client library for Python. When using the low-level API via `ProxyManager.connection_from_url().urlopen()` with `assert_same_host=False`, cross-origin redirects can still forward sensitive headers. This could allow a remote attacker to gain unauthorized access to sensitive information.
5.9 (Medium)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-advisor-backend-rhel9@sha256:5ea1978e2dbe0d44d9046f212d5bfd9714f667057392c559b26fff8758d624c7_amd64 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
A flaw was found in urllib3, an HTTP client library for Python. This vulnerability allows a remote attacker to cause excessive resource consumption, such as high CPU usage and massive memory allocation, on the client side. This occurs when urllib3 attempts to decompress an entire HTTP response, even if only a partial read was requested, or when draining the connection after a partial decompression. This can lead to a Denial of Service (DoS) condition.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-advisor-backend-rhel9@sha256:5ea1978e2dbe0d44d9046f212d5bfd9714f667057392c559b26fff8758d624c7_amd64 | — |
Vendor Fix
fix
|
Threats
Impact
Important
References
19 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "A new satellite/iop-advisor-backend-rhel9 container image is now generally available in the Red Hat container registry.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat Lightspeed in Satellite analyzes system health and configuration by applying predefined rules to a small set of local data, such as installed packages, running services, and configuration settings. When you install Red Hat Lightspeed in Satellite locally, you can generate Red Hat Lightspeed recommendations without sending system data to Red Hat services. ",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:51206",
"url": "https://access.redhat.com/errata/RHSA-2026:51206"
},
{
"category": "external",
"summary": "https://access.redhat.com/documentation/en-us/red_hat_satellite/6.19/html/updating_red_hat_satellite/index",
"url": "https://access.redhat.com/documentation/en-us/red_hat_satellite/6.19/html/updating_red_hat_satellite/index"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-44431",
"url": "https://access.redhat.com/security/cve/CVE-2026-44431"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-44432",
"url": "https://access.redhat.com/security/cve/CVE-2026-44432"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://catalog.redhat.com/software/containers/search",
"url": "https://catalog.redhat.com/software/containers/search"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/installing_satellite_server_in_a_connected_network_environment/performing-additional-configuration-on-server_satellite#installing-and-configuring-red-hat-lightspeed-in-satellite",
"url": "https://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/installing_satellite_server_in_a_connected_network_environment/performing-additional-configuration-on-server_satellite#installing-and-configuring-red-hat-lightspeed-in-satellite"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/installing_satellite_server_in_a_disconnected_network_environment/performing-additional-configuration#installing-and-configuring-red-hat-lightspeed-in-satellite",
"url": "https://docs.redhat.com/en/documentation/red_hat_satellite/6.19/html/installing_satellite_server_in_a_disconnected_network_environment/performing-additional-configuration#installing-and-configuring-red-hat-lightspeed-in-satellite"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_51206.json"
}
],
"title": "Red Hat Security Advisory: General availability of the satellite/iop-advisor-backend-rhel9 container image",
"tracking": {
"current_release_date": "2026-08-08T16:10:58+00:00",
"generator": {
"date": "2026-08-08T16:10:58+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.12"
}
},
"id": "RHSA-2026:51206",
"initial_release_date": "2026-08-06T17:41:12+00:00",
"revision_history": [
{
"date": "2026-08-06T17:41:12+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-08-08T04:36:23+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-08T16:10:58+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Satellite 6.19",
"product": {
"name": "Red Hat Satellite 6.19",
"product_id": "Red Hat Satellite 6.19",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:satellite:6.19::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat Satellite"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/satellite/iop-advisor-backend-rhel9@sha256:5ea1978e2dbe0d44d9046f212d5bfd9714f667057392c559b26fff8758d624c7_amd64",
"product": {
"name": "registry.redhat.io/satellite/iop-advisor-backend-rhel9@sha256:5ea1978e2dbe0d44d9046f212d5bfd9714f667057392c559b26fff8758d624c7_amd64",
"product_id": "registry.redhat.io/satellite/iop-advisor-backend-rhel9@sha256:5ea1978e2dbe0d44d9046f212d5bfd9714f667057392c559b26fff8758d624c7_amd64",
"product_identification_helper": {
"purl": "pkg:oci/iop-advisor-backend-rhel9@sha256%3A5ea1978e2dbe0d44d9046f212d5bfd9714f667057392c559b26fff8758d624c7?arch=amd64\u0026repository_url=registry.redhat.io/satellite/iop-advisor-backend-rhel9\u0026tag=1784558259"
}
}
}
],
"category": "architecture",
"name": "amd64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/satellite/iop-advisor-backend-rhel9@sha256:5ea1978e2dbe0d44d9046f212d5bfd9714f667057392c559b26fff8758d624c7_amd64 as a component of Red Hat Satellite 6.19",
"product_id": "Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-advisor-backend-rhel9@sha256:5ea1978e2dbe0d44d9046f212d5bfd9714f667057392c559b26fff8758d624c7_amd64"
},
"product_reference": "registry.redhat.io/satellite/iop-advisor-backend-rhel9@sha256:5ea1978e2dbe0d44d9046f212d5bfd9714f667057392c559b26fff8758d624c7_amd64",
"relates_to_product_reference": "Red Hat Satellite 6.19"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-44431",
"cwe": {
"id": "CWE-201",
"name": "Insertion of Sensitive Information Into Sent Data"
},
"discovery_date": "2026-05-13T17:01:41.663622+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477167"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in urllib3, an HTTP client library for Python. When using the low-level API via `ProxyManager.connection_from_url().urlopen()` with `assert_same_host=False`, cross-origin redirects can still forward sensitive headers. This could allow a remote attacker to gain unauthorized access to sensitive information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-advisor-backend-rhel9@sha256:5ea1978e2dbe0d44d9046f212d5bfd9714f667057392c559b26fff8758d624c7_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44431"
},
{
"category": "external",
"summary": "RHBZ#2477167",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477167"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44431",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44431"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44431",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44431"
},
{
"category": "external",
"summary": "https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc",
"url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc"
}
],
"release_date": "2026-05-13T15:20:24.588000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-06T17:41:12+00:00",
"details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
"product_ids": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-advisor-backend-rhel9@sha256:5ea1978e2dbe0d44d9046f212d5bfd9714f667057392c559b26fff8758d624c7_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:51206"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-advisor-backend-rhel9@sha256:5ea1978e2dbe0d44d9046f212d5bfd9714f667057392c559b26fff8758d624c7_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers"
},
{
"cve": "CVE-2026-44432",
"cwe": {
"id": "CWE-409",
"name": "Improper Handling of Highly Compressed Data (Data Amplification)"
},
"discovery_date": "2026-05-13T17:01:01.083841+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477154"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in urllib3, an HTTP client library for Python. This vulnerability allows a remote attacker to cause excessive resource consumption, such as high CPU usage and massive memory allocation, on the client side. This occurs when urllib3 attempts to decompress an entire HTTP response, even if only a partial read was requested, or when draining the connection after a partial decompression. This can lead to a Denial of Service (DoS) condition.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-advisor-backend-rhel9@sha256:5ea1978e2dbe0d44d9046f212d5bfd9714f667057392c559b26fff8758d624c7_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44432"
},
{
"category": "external",
"summary": "RHBZ#2477154",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477154"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44432",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44432"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44432",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44432"
},
{
"category": "external",
"summary": "https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j",
"url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j"
}
],
"release_date": "2026-05-13T15:17:12.611000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-06T17:41:12+00:00",
"details": "For Red Hat Lightspeed in Satellite installation see the Red Hat Satellite documentation.",
"product_ids": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-advisor-backend-rhel9@sha256:5ea1978e2dbe0d44d9046f212d5bfd9714f667057392c559b26fff8758d624c7_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:51206"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Satellite 6.19:registry.redhat.io/satellite/iop-advisor-backend-rhel9@sha256:5ea1978e2dbe0d44d9046f212d5bfd9714f667057392c559b26fff8758d624c7_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression"
}
]
}
RHSA-2026:7625
Vulnerability from csaf_redhat - Published: 2026-04-11 00:01 - Updated: 2026-08-09 06:24Summary
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
Severity
Important
Notes
Topic: An update for Red Hat Hardened Images RPMs is now available.
Details: This update includes the following RPMs:
python-sentry-sdk:
* python3-sentry-sdk+aiohttp-2.48.0-4.1.hum1 (noarch)
* python3-sentry-sdk+asyncpg-2.48.0-4.1.hum1 (noarch)
* python3-sentry-sdk+bottle-2.48.0-4.1.hum1 (noarch)
* python3-sentry-sdk+celery-2.48.0-4.1.hum1 (noarch)
* python3-sentry-sdk+django-2.48.0-4.1.hum1 (noarch)
* python3-sentry-sdk+falcon-2.48.0-4.1.hum1 (noarch)
* python3-sentry-sdk+fastapi-2.48.0-4.1.hum1 (noarch)
* python3-sentry-sdk+flask-2.48.0-4.1.hum1 (noarch)
* python3-sentry-sdk+grpcio-2.48.0-4.1.hum1 (noarch)
* python3-sentry-sdk+http2-2.48.0-4.1.hum1 (noarch)
* python3-sentry-sdk+httpx-2.48.0-4.1.hum1 (noarch)
* python3-sentry-sdk+pure_eval-2.48.0-4.1.hum1 (noarch)
* python3-sentry-sdk+pymongo-2.48.0-4.1.hum1 (noarch)
* python3-sentry-sdk+rq-2.48.0-4.1.hum1 (noarch)
* python3-sentry-sdk+sqlalchemy-2.48.0-4.1.hum1 (noarch)
* python3-sentry-sdk+starlette-2.48.0-4.1.hum1 (noarch)
* python3-sentry-sdk+tornado-2.48.0-4.1.hum1 (noarch)
* python3-sentry-sdk-2.48.0-4.1.hum1 (noarch)
* python-sentry-sdk-2.48.0-4.1.hum1.src (src)
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in urllib3, an HTTP client library for Python. This vulnerability allows a remote attacker to cause excessive resource consumption, such as high CPU usage and massive memory allocation, on the client side. This occurs when urllib3 attempts to decompress an entire HTTP response, even if only a partial read was requested, or when draining the connection after a partial decompression. This can lead to a Denial of Service (DoS) condition.
7.5 (High)
Affected products
Threats
Impact
Important
References
10 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for Red Hat Hardened Images RPMs is now available.",
"title": "Topic"
},
{
"category": "general",
"text": "This update includes the following RPMs:\n\npython-sentry-sdk:\n * python3-sentry-sdk+aiohttp-2.48.0-4.1.hum1 (noarch)\n * python3-sentry-sdk+asyncpg-2.48.0-4.1.hum1 (noarch)\n * python3-sentry-sdk+bottle-2.48.0-4.1.hum1 (noarch)\n * python3-sentry-sdk+celery-2.48.0-4.1.hum1 (noarch)\n * python3-sentry-sdk+django-2.48.0-4.1.hum1 (noarch)\n * python3-sentry-sdk+falcon-2.48.0-4.1.hum1 (noarch)\n * python3-sentry-sdk+fastapi-2.48.0-4.1.hum1 (noarch)\n * python3-sentry-sdk+flask-2.48.0-4.1.hum1 (noarch)\n * python3-sentry-sdk+grpcio-2.48.0-4.1.hum1 (noarch)\n * python3-sentry-sdk+http2-2.48.0-4.1.hum1 (noarch)\n * python3-sentry-sdk+httpx-2.48.0-4.1.hum1 (noarch)\n * python3-sentry-sdk+pure_eval-2.48.0-4.1.hum1 (noarch)\n * python3-sentry-sdk+pymongo-2.48.0-4.1.hum1 (noarch)\n * python3-sentry-sdk+rq-2.48.0-4.1.hum1 (noarch)\n * python3-sentry-sdk+sqlalchemy-2.48.0-4.1.hum1 (noarch)\n * python3-sentry-sdk+starlette-2.48.0-4.1.hum1 (noarch)\n * python3-sentry-sdk+tornado-2.48.0-4.1.hum1 (noarch)\n * python3-sentry-sdk-2.48.0-4.1.hum1 (noarch)\n * python-sentry-sdk-2.48.0-4.1.hum1.src (src)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:7625",
"url": "https://access.redhat.com/errata/RHSA-2026:7625"
},
{
"category": "external",
"summary": "https://images.redhat.com/",
"url": "https://images.redhat.com/"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-44432",
"url": "https://access.redhat.com/security/cve/CVE-2026-44432"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7625.json"
}
],
"title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
"tracking": {
"current_release_date": "2026-08-09T06:24:11+00:00",
"generator": {
"date": "2026-08-09T06:24:11+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.12"
}
},
"id": "RHSA-2026:7625",
"initial_release_date": "2026-04-11T00:01:39+00:00",
"revision_history": [
{
"date": "2026-04-11T00:01:39+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-08-08T04:36:23+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-09T06:24:11+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Hardened Images",
"product": {
"name": "Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:hummingbird:1"
}
}
}
],
"category": "product_family",
"name": "Red Hat Hardened Images"
},
{
"branches": [
{
"category": "product_version",
"name": "python-sentry-sdk-main@src",
"product": {
"name": "python-sentry-sdk-main@src",
"product_id": "python-sentry-sdk-main@src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-sentry-sdk@2.48.0-4.1.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "python-sentry-sdk-main@noarch",
"product": {
"name": "python-sentry-sdk-main@noarch",
"product_id": "python-sentry-sdk-main@noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-sentry-sdk+aiohttp@2.48.0-4.1.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "python-sentry-sdk-main@noarch as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:python-sentry-sdk-main@noarch"
},
"product_reference": "python-sentry-sdk-main@noarch",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-sentry-sdk-main@src as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:python-sentry-sdk-main@src"
},
"product_reference": "python-sentry-sdk-main@src",
"relates_to_product_reference": "Red Hat Hardened Images"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-44432",
"cwe": {
"id": "CWE-409",
"name": "Improper Handling of Highly Compressed Data (Data Amplification)"
},
"discovery_date": "2026-05-13T17:01:01.083841+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477154"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in urllib3, an HTTP client library for Python. This vulnerability allows a remote attacker to cause excessive resource consumption, such as high CPU usage and massive memory allocation, on the client side. This occurs when urllib3 attempts to decompress an entire HTTP response, even if only a partial read was requested, or when draining the connection after a partial decompression. This can lead to a Denial of Service (DoS) condition.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:python-sentry-sdk-main@noarch",
"Red Hat Hardened Images:python-sentry-sdk-main@src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44432"
},
{
"category": "external",
"summary": "RHBZ#2477154",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477154"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44432",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44432"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44432",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44432"
},
{
"category": "external",
"summary": "https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j",
"url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j"
}
],
"release_date": "2026-05-13T15:17:12.611000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-11T00:01:39+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:python-sentry-sdk-main@noarch",
"Red Hat Hardened Images:python-sentry-sdk-main@src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:7625"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:python-sentry-sdk-main@noarch",
"Red Hat Hardened Images:python-sentry-sdk-main@src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression"
}
]
}
RHSA-2026:7634
Vulnerability from csaf_redhat - Published: 2026-04-11 00:15 - Updated: 2026-08-11 10:43Summary
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
Severity
Important
Notes
Topic: An update for Red Hat Hardened Images RPMs is now available.
Details: This update includes the following RPMs:
llvm:
* clang-21.1.8-1.1.hum1 (aarch64, x86_64)
* clang-analyzer-21.1.8-1.1.hum1 (aarch64, x86_64)
* clang-devel-21.1.8-1.1.hum1 (aarch64, x86_64)
* clang-libs-21.1.8-1.1.hum1 (aarch64, x86_64)
* clang-resource-filesystem-21.1.8-1.1.hum1 (aarch64, x86_64)
* clang-tools-extra-21.1.8-1.1.hum1 (aarch64, x86_64)
* clang-tools-extra-devel-21.1.8-1.1.hum1 (aarch64, x86_64)
* compiler-rt-21.1.8-1.1.hum1 (aarch64, x86_64)
* git-clang-format-21.1.8-1.1.hum1 (aarch64, x86_64)
* libcxx-21.1.8-1.1.hum1 (aarch64, x86_64)
* libcxx-devel-21.1.8-1.1.hum1 (aarch64, x86_64)
* libcxx-static-21.1.8-1.1.hum1 (aarch64, x86_64)
* libcxxabi-21.1.8-1.1.hum1 (aarch64, x86_64)
* libcxxabi-devel-21.1.8-1.1.hum1 (aarch64, x86_64)
* libcxxabi-static-21.1.8-1.1.hum1 (aarch64, x86_64)
* libomp-21.1.8-1.1.hum1 (aarch64, x86_64)
* libomp-devel-21.1.8-1.1.hum1 (aarch64, x86_64)
* lld-21.1.8-1.1.hum1 (aarch64, x86_64)
* lld-devel-21.1.8-1.1.hum1 (aarch64, x86_64)
* lld-libs-21.1.8-1.1.hum1 (aarch64, x86_64)
* lldb-21.1.8-1.1.hum1 (aarch64, x86_64)
* lldb-devel-21.1.8-1.1.hum1 (aarch64, x86_64)
* llvm-21.1.8-1.1.hum1 (aarch64, x86_64)
* llvm-bolt-21.1.8-1.1.hum1 (aarch64, x86_64)
* llvm-cmake-utils-21.1.8-1.1.hum1 (aarch64, x86_64)
* llvm-devel-21.1.8-1.1.hum1 (aarch64, x86_64)
* llvm-doc-21.1.8-1.1.hum1 (noarch)
* llvm-filesystem-21.1.8-1.1.hum1 (aarch64, x86_64)
* llvm-googletest-21.1.8-1.1.hum1 (aarch64, x86_64)
* llvm-libs-21.1.8-1.1.hum1 (aarch64, x86_64)
* llvm-libunwind-21.1.8-1.1.hum1 (aarch64, x86_64)
* llvm-libunwind-devel-21.1.8-1.1.hum1 (aarch64, x86_64)
* llvm-libunwind-static-21.1.8-1.1.hum1 (aarch64, x86_64)
* llvm-static-21.1.8-1.1.hum1 (aarch64, x86_64)
* llvm-test-21.1.8-1.1.hum1 (aarch64, x86_64)
* mlir-21.1.8-1.1.hum1 (aarch64, x86_64)
* mlir-devel-21.1.8-1.1.hum1 (aarch64, x86_64)
* mlir-static-21.1.8-1.1.hum1 (aarch64, x86_64)
* polly-21.1.8-1.1.hum1 (aarch64, x86_64)
* polly-devel-21.1.8-1.1.hum1 (aarch64, x86_64)
* python3-clang-21.1.8-1.1.hum1 (aarch64, x86_64)
* python3-lit-21.1.8-1.1.hum1 (noarch)
* python3-lldb-21.1.8-1.1.hum1 (aarch64, x86_64)
* python3-mlir-21.1.8-1.1.hum1 (aarch64, x86_64)
* llvm-21.1.8-1.1.hum1.src (src)
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in llvm. A local attacker could exploit a stack-based buffer overflow vulnerability in the `llvm::StringMap::insert` function. This manipulation could lead to a denial of service, making the affected system or application unavailable.
CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Hardened Images:llvm-main@aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:llvm-main@noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:llvm-main@src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:llvm-main@x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Low
A flaw was found in llvm. A local attacker could exploit a heap-based buffer overflow vulnerability in the GCRelocateInst::getBasePtr function within the Bitcode File Handler component. This flaw could lead to a denial of service, making the affected system unavailable.
CWE-805 - Buffer Access with Incorrect Length ValueAffected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Hardened Images:llvm-main@aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:llvm-main@noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:llvm-main@src | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:llvm-main@x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Low
A flaw was found in urllib3, an HTTP client library for Python. This vulnerability allows a remote attacker to cause excessive resource consumption, such as high CPU usage and massive memory allocation, on the client side. This occurs when urllib3 attempts to decompress an entire HTTP response, even if only a partial read was requested, or when draining the connection after a partial decompression. This can lead to a Denial of Service (DoS) condition.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Hardened Images:llvm-main@aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:llvm-main@noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:llvm-main@src | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:llvm-main@x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in the brace-expansion library. This vulnerability allows an attacker to cause a Denial of Service (DoS) by providing a large numeric range for expansion. The library allocates excessive memory to generate all intermediate elements before applying the maximum limit, leading to high memory consumption and potential application crashes. This can impact the availability of systems using the library.
6.5 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Hardened Images:llvm-main@aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:llvm-main@noarch | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:llvm-main@src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:llvm-main@x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
References
39 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for Red Hat Hardened Images RPMs is now available.",
"title": "Topic"
},
{
"category": "general",
"text": "This update includes the following RPMs:\n\nllvm:\n * clang-21.1.8-1.1.hum1 (aarch64, x86_64)\n * clang-analyzer-21.1.8-1.1.hum1 (aarch64, x86_64)\n * clang-devel-21.1.8-1.1.hum1 (aarch64, x86_64)\n * clang-libs-21.1.8-1.1.hum1 (aarch64, x86_64)\n * clang-resource-filesystem-21.1.8-1.1.hum1 (aarch64, x86_64)\n * clang-tools-extra-21.1.8-1.1.hum1 (aarch64, x86_64)\n * clang-tools-extra-devel-21.1.8-1.1.hum1 (aarch64, x86_64)\n * compiler-rt-21.1.8-1.1.hum1 (aarch64, x86_64)\n * git-clang-format-21.1.8-1.1.hum1 (aarch64, x86_64)\n * libcxx-21.1.8-1.1.hum1 (aarch64, x86_64)\n * libcxx-devel-21.1.8-1.1.hum1 (aarch64, x86_64)\n * libcxx-static-21.1.8-1.1.hum1 (aarch64, x86_64)\n * libcxxabi-21.1.8-1.1.hum1 (aarch64, x86_64)\n * libcxxabi-devel-21.1.8-1.1.hum1 (aarch64, x86_64)\n * libcxxabi-static-21.1.8-1.1.hum1 (aarch64, x86_64)\n * libomp-21.1.8-1.1.hum1 (aarch64, x86_64)\n * libomp-devel-21.1.8-1.1.hum1 (aarch64, x86_64)\n * lld-21.1.8-1.1.hum1 (aarch64, x86_64)\n * lld-devel-21.1.8-1.1.hum1 (aarch64, x86_64)\n * lld-libs-21.1.8-1.1.hum1 (aarch64, x86_64)\n * lldb-21.1.8-1.1.hum1 (aarch64, x86_64)\n * lldb-devel-21.1.8-1.1.hum1 (aarch64, x86_64)\n * llvm-21.1.8-1.1.hum1 (aarch64, x86_64)\n * llvm-bolt-21.1.8-1.1.hum1 (aarch64, x86_64)\n * llvm-cmake-utils-21.1.8-1.1.hum1 (aarch64, x86_64)\n * llvm-devel-21.1.8-1.1.hum1 (aarch64, x86_64)\n * llvm-doc-21.1.8-1.1.hum1 (noarch)\n * llvm-filesystem-21.1.8-1.1.hum1 (aarch64, x86_64)\n * llvm-googletest-21.1.8-1.1.hum1 (aarch64, x86_64)\n * llvm-libs-21.1.8-1.1.hum1 (aarch64, x86_64)\n * llvm-libunwind-21.1.8-1.1.hum1 (aarch64, x86_64)\n * llvm-libunwind-devel-21.1.8-1.1.hum1 (aarch64, x86_64)\n * llvm-libunwind-static-21.1.8-1.1.hum1 (aarch64, x86_64)\n * llvm-static-21.1.8-1.1.hum1 (aarch64, x86_64)\n * llvm-test-21.1.8-1.1.hum1 (aarch64, x86_64)\n * mlir-21.1.8-1.1.hum1 (aarch64, x86_64)\n * mlir-devel-21.1.8-1.1.hum1 (aarch64, x86_64)\n * mlir-static-21.1.8-1.1.hum1 (aarch64, x86_64)\n * polly-21.1.8-1.1.hum1 (aarch64, x86_64)\n * polly-devel-21.1.8-1.1.hum1 (aarch64, x86_64)\n * python3-clang-21.1.8-1.1.hum1 (aarch64, x86_64)\n * python3-lit-21.1.8-1.1.hum1 (noarch)\n * python3-lldb-21.1.8-1.1.hum1 (aarch64, x86_64)\n * python3-mlir-21.1.8-1.1.hum1 (aarch64, x86_64)\n * llvm-21.1.8-1.1.hum1.src (src)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:7634",
"url": "https://access.redhat.com/errata/RHSA-2026:7634"
},
{
"category": "external",
"summary": "https://images.redhat.com/",
"url": "https://images.redhat.com/"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-45149",
"url": "https://access.redhat.com/security/cve/CVE-2026-45149"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-44432",
"url": "https://access.redhat.com/security/cve/CVE-2026-44432"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-13573",
"url": "https://access.redhat.com/security/cve/CVE-2026-13573"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-13574",
"url": "https://access.redhat.com/security/cve/CVE-2026-13574"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7634.json"
}
],
"title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
"tracking": {
"current_release_date": "2026-08-11T10:43:43+00:00",
"generator": {
"date": "2026-08-11T10:43:43+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.14"
}
},
"id": "RHSA-2026:7634",
"initial_release_date": "2026-04-11T00:15:28+00:00",
"revision_history": [
{
"date": "2026-04-11T00:15:28+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-08-08T04:36:23+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-11T10:43:43+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Hardened Images",
"product": {
"name": "Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:hummingbird:1"
}
}
}
],
"category": "product_family",
"name": "Red Hat Hardened Images"
},
{
"branches": [
{
"category": "product_version",
"name": "llvm-main@aarch64",
"product": {
"name": "llvm-main@aarch64",
"product_id": "llvm-main@aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/clang@21.1.8-1.1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "llvm-main@x86_64",
"product": {
"name": "llvm-main@x86_64",
"product_id": "llvm-main@x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/clang@21.1.8-1.1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "llvm-main@src",
"product": {
"name": "llvm-main@src",
"product_id": "llvm-main@src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/llvm@21.1.8-1.1.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "llvm-main@noarch",
"product": {
"name": "llvm-main@noarch",
"product_id": "llvm-main@noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/llvm-doc@21.1.8-1.1.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "llvm-main@aarch64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:llvm-main@aarch64"
},
"product_reference": "llvm-main@aarch64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "llvm-main@noarch as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:llvm-main@noarch"
},
"product_reference": "llvm-main@noarch",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "llvm-main@src as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:llvm-main@src"
},
"product_reference": "llvm-main@src",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "llvm-main@x86_64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:llvm-main@x86_64"
},
"product_reference": "llvm-main@x86_64",
"relates_to_product_reference": "Red Hat Hardened Images"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-13573",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2026-06-29T15:01:19.470118+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2494424"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in llvm. A local attacker could exploit a stack-based buffer overflow vulnerability in the `llvm::StringMap::insert` function. This manipulation could lead to a denial of service, making the affected system or application unavailable.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "llvm: llvm: Denial of Service via stack-based buffer overflow in StringMap::insert",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw has a Low impact as it requires a local attacker to exploit a stack-based buffer overflow in the `llvm::StringMap::insert` function. Successful exploitation could lead to a denial of service, affecting the availability of systems utilizing the vulnerable LLVM component. The vulnerability is limited to local access, reducing its overall risk in typical Red Hat deployments.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:llvm-main@aarch64",
"Red Hat Hardened Images:llvm-main@noarch",
"Red Hat Hardened Images:llvm-main@src",
"Red Hat Hardened Images:llvm-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-13573"
},
{
"category": "external",
"summary": "RHBZ#2494424",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494424"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-13573",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-13573"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-13573",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13573"
},
{
"category": "external",
"summary": "https://github.com/llvm/llvm-project/",
"url": "https://github.com/llvm/llvm-project/"
},
{
"category": "external",
"summary": "https://github.com/llvm/llvm-project/issues/199187",
"url": "https://github.com/llvm/llvm-project/issues/199187"
},
{
"category": "external",
"summary": "https://github.com/user-attachments/files/28141697/poc.zip",
"url": "https://github.com/user-attachments/files/28141697/poc.zip"
},
{
"category": "external",
"summary": "https://vuldb.com/cve/CVE-2026-13573",
"url": "https://vuldb.com/cve/CVE-2026-13573"
},
{
"category": "external",
"summary": "https://vuldb.com/submit/844457",
"url": "https://vuldb.com/submit/844457"
},
{
"category": "external",
"summary": "https://vuldb.com/vuln/374581",
"url": "https://vuldb.com/vuln/374581"
},
{
"category": "external",
"summary": "https://vuldb.com/vuln/374581/cti",
"url": "https://vuldb.com/vuln/374581/cti"
}
],
"release_date": "2026-06-29T14:00:09.309000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-11T00:15:28+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:llvm-main@aarch64",
"Red Hat Hardened Images:llvm-main@noarch",
"Red Hat Hardened Images:llvm-main@src",
"Red Hat Hardened Images:llvm-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:7634"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat Hardened Images:llvm-main@aarch64",
"Red Hat Hardened Images:llvm-main@noarch",
"Red Hat Hardened Images:llvm-main@src",
"Red Hat Hardened Images:llvm-main@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 3.3,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:llvm-main@aarch64",
"Red Hat Hardened Images:llvm-main@noarch",
"Red Hat Hardened Images:llvm-main@src",
"Red Hat Hardened Images:llvm-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "llvm: llvm: Denial of Service via stack-based buffer overflow in StringMap::insert"
},
{
"cve": "CVE-2026-13574",
"cwe": {
"id": "CWE-805",
"name": "Buffer Access with Incorrect Length Value"
},
"discovery_date": "2026-06-29T15:00:56.609872+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2494420"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in llvm. A local attacker could exploit a heap-based buffer overflow vulnerability in the GCRelocateInst::getBasePtr function within the Bitcode File Handler component. This flaw could lead to a denial of service, making the affected system unavailable.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "llvm: llvm-project: LLVM: Denial of service via heap-based buffer overflow in Bitcode File Handler",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability has a Low impact, as it requires a local attacker to exploit a heap-based buffer overflow in the LLVM Bitcode File Handler. Successful exploitation could lead to a denial of service by making the affected system unavailable.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:llvm-main@aarch64",
"Red Hat Hardened Images:llvm-main@noarch",
"Red Hat Hardened Images:llvm-main@src",
"Red Hat Hardened Images:llvm-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-13574"
},
{
"category": "external",
"summary": "RHBZ#2494420",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494420"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-13574",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-13574"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-13574",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13574"
},
{
"category": "external",
"summary": "https://github.com/llvm/llvm-project/",
"url": "https://github.com/llvm/llvm-project/"
},
{
"category": "external",
"summary": "https://github.com/llvm/llvm-project/issues/199191",
"url": "https://github.com/llvm/llvm-project/issues/199191"
},
{
"category": "external",
"summary": "https://github.com/user-attachments/files/28142619/poc.zip",
"url": "https://github.com/user-attachments/files/28142619/poc.zip"
},
{
"category": "external",
"summary": "https://vuldb.com/cve/CVE-2026-13574",
"url": "https://vuldb.com/cve/CVE-2026-13574"
},
{
"category": "external",
"summary": "https://vuldb.com/submit/844468",
"url": "https://vuldb.com/submit/844468"
},
{
"category": "external",
"summary": "https://vuldb.com/vuln/374582",
"url": "https://vuldb.com/vuln/374582"
},
{
"category": "external",
"summary": "https://vuldb.com/vuln/374582/cti",
"url": "https://vuldb.com/vuln/374582/cti"
}
],
"release_date": "2026-06-29T14:15:09.190000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-11T00:15:28+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:llvm-main@aarch64",
"Red Hat Hardened Images:llvm-main@noarch",
"Red Hat Hardened Images:llvm-main@src",
"Red Hat Hardened Images:llvm-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:7634"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 3.3,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:llvm-main@aarch64",
"Red Hat Hardened Images:llvm-main@noarch",
"Red Hat Hardened Images:llvm-main@src",
"Red Hat Hardened Images:llvm-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "llvm: llvm-project: LLVM: Denial of service via heap-based buffer overflow in Bitcode File Handler"
},
{
"cve": "CVE-2026-44432",
"cwe": {
"id": "CWE-409",
"name": "Improper Handling of Highly Compressed Data (Data Amplification)"
},
"discovery_date": "2026-05-13T17:01:01.083841+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477154"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in urllib3, an HTTP client library for Python. This vulnerability allows a remote attacker to cause excessive resource consumption, such as high CPU usage and massive memory allocation, on the client side. This occurs when urllib3 attempts to decompress an entire HTTP response, even if only a partial read was requested, or when draining the connection after a partial decompression. This can lead to a Denial of Service (DoS) condition.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:llvm-main@aarch64",
"Red Hat Hardened Images:llvm-main@noarch",
"Red Hat Hardened Images:llvm-main@src",
"Red Hat Hardened Images:llvm-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44432"
},
{
"category": "external",
"summary": "RHBZ#2477154",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477154"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44432",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44432"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44432",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44432"
},
{
"category": "external",
"summary": "https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j",
"url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j"
}
],
"release_date": "2026-05-13T15:17:12.611000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-11T00:15:28+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:llvm-main@aarch64",
"Red Hat Hardened Images:llvm-main@noarch",
"Red Hat Hardened Images:llvm-main@src",
"Red Hat Hardened Images:llvm-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:7634"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:llvm-main@aarch64",
"Red Hat Hardened Images:llvm-main@noarch",
"Red Hat Hardened Images:llvm-main@src",
"Red Hat Hardened Images:llvm-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression"
},
{
"cve": "CVE-2026-45149",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-05-29T21:02:00.092772+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2483481"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the brace-expansion library. This vulnerability allows an attacker to cause a Denial of Service (DoS) by providing a large numeric range for expansion. The library allocates excessive memory to generate all intermediate elements before applying the maximum limit, leading to high memory consumption and potential application crashes. This can impact the availability of systems using the library.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "brace-expansion: brace-expansion: Denial of Service due to excessive memory allocation when expanding large numeric ranges",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products ship brace-expansion versions 1.x and 2.x, which are not affected by this vulnerability. The flaw exists only in versions 5.0.0 through 5.0.5.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:llvm-main@aarch64",
"Red Hat Hardened Images:llvm-main@noarch",
"Red Hat Hardened Images:llvm-main@src",
"Red Hat Hardened Images:llvm-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-45149"
},
{
"category": "external",
"summary": "RHBZ#2483481",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483481"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-45149",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-45149"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-45149",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45149"
},
{
"category": "external",
"summary": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2",
"url": "https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2"
}
],
"release_date": "2026-05-29T19:55:07.337000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-11T00:15:28+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:llvm-main@aarch64",
"Red Hat Hardened Images:llvm-main@noarch",
"Red Hat Hardened Images:llvm-main@src",
"Red Hat Hardened Images:llvm-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:7634"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Hardened Images:llvm-main@aarch64",
"Red Hat Hardened Images:llvm-main@noarch",
"Red Hat Hardened Images:llvm-main@src",
"Red Hat Hardened Images:llvm-main@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:llvm-main@aarch64",
"Red Hat Hardened Images:llvm-main@noarch",
"Red Hat Hardened Images:llvm-main@src",
"Red Hat Hardened Images:llvm-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "brace-expansion: brace-expansion: Denial of Service due to excessive memory allocation when expanding large numeric ranges"
}
]
}
rlsa-2026:27929
Vulnerability from osv_rocky
Published
2026-06-24 12:05
Modified
2026-07-08 12:08
Summary
Important: python3.14-urllib3 security update
Details
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.
Security Fix(es):
-
urllib3: urllib3: Denial of Service due to excessive HTTP response decompression (CVE-2026-44432)
-
urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers (CVE-2026-44431)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Severity
7.5 (High)
Credits
Rocky Enterprise Software Foundation
Red Hat
References
{
"affected": [
{
"package": {
"ecosystem": "Rocky Linux:10",
"name": "python3.14-urllib3",
"purl": "pkg:rpm/rocky-linux/python3.14-urllib3?distro=rocky-linux-10-aarch64\u0026epoch=0"
},
"ranges": [
{
"database_specific": {
"yum_repository": "AppStream"
},
"events": [
{
"introduced": "0"
},
{
"fixed": "0:2.6.3-2.el10_2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"credits": [
{
"name": "Rocky Enterprise Software Foundation"
},
{
"name": "Red Hat"
}
],
"details": "Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.\n\nSecurity Fix(es):\n\n* urllib3: urllib3: Denial of Service due to excessive HTTP response decompression (CVE-2026-44432)\n\n* urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers (CVE-2026-44431)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"id": "RLSA-2026:27929",
"modified": "2026-07-08T12:08:28.028427Z",
"published": "2026-06-24T12:05:09.232192Z",
"references": [
{
"type": "ADVISORY",
"url": "https://errata.rockylinux.org/RLSA-2026:27929"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477154"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477167"
}
],
"schema_version": "1.7.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Important: python3.14-urllib3 security update",
"upstream": [
"CVE-2026-44431",
"CVE-2026-44432"
]
}
rlsa-2026:28000
Vulnerability from osv_rocky
Published
2026-06-24 12:05
Modified
2026-07-08 12:08
Summary
Important: python-urllib3 security update
Details
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.
Security Fix(es):
-
urllib3: urllib3: Denial of Service due to excessive HTTP response decompression (CVE-2026-44432)
-
urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers (CVE-2026-44431)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Severity
7.5 (High)
Credits
Rocky Enterprise Software Foundation
Red Hat
References
{
"affected": [
{
"package": {
"ecosystem": "Rocky Linux:10",
"name": "python-urllib3",
"purl": "pkg:rpm/rocky-linux/python-urllib3?distro=rocky-linux-10-aarch64\u0026epoch=0"
},
"ranges": [
{
"database_specific": {
"yum_repository": "BaseOS"
},
"events": [
{
"introduced": "0"
},
{
"fixed": "0:1.26.19-4.el10_2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"credits": [
{
"name": "Rocky Enterprise Software Foundation"
},
{
"name": "Red Hat"
}
],
"details": "Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.\n\nSecurity Fix(es):\n\n* urllib3: urllib3: Denial of Service due to excessive HTTP response decompression (CVE-2026-44432)\n\n* urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers (CVE-2026-44431)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"id": "RLSA-2026:28000",
"modified": "2026-07-08T12:08:30.104852Z",
"published": "2026-06-24T12:05:16.082804Z",
"references": [
{
"type": "ADVISORY",
"url": "https://errata.rockylinux.org/RLSA-2026:28000"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477154"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477167"
}
],
"schema_version": "1.7.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Important: python-urllib3 security update",
"upstream": [
"CVE-2026-44431",
"CVE-2026-44432"
]
}
rlsa-2026:28157
Vulnerability from osv_rocky
Published
2026-06-24 12:03
Modified
2026-07-08 12:08
Summary
Important: python3.14-urllib3 security update
Details
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.
Security Fix(es):
-
urllib3: urllib3: Denial of Service due to excessive HTTP response decompression (CVE-2026-44432)
-
urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers (CVE-2026-44431)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Severity
7.5 (High)
Credits
Rocky Enterprise Software Foundation
Red Hat
References
{
"affected": [
{
"package": {
"ecosystem": "Rocky Linux:9",
"name": "python3.14-urllib3",
"purl": "pkg:rpm/rocky-linux/python3.14-urllib3?distro=rocky-linux-9-x86-64\u0026epoch=0"
},
"ranges": [
{
"database_specific": {
"yum_repository": "AppStream"
},
"events": [
{
"introduced": "0"
},
{
"fixed": "0:2.6.3-2.el9_8"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"credits": [
{
"name": "Rocky Enterprise Software Foundation"
},
{
"name": "Red Hat"
}
],
"details": "Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.\n\nSecurity Fix(es):\n\n* urllib3: urllib3: Denial of Service due to excessive HTTP response decompression (CVE-2026-44432)\n\n* urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers (CVE-2026-44431)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"id": "RLSA-2026:28157",
"modified": "2026-07-08T12:08:23.375365Z",
"published": "2026-06-24T12:03:26.635873Z",
"references": [
{
"type": "ADVISORY",
"url": "https://errata.rockylinux.org/RLSA-2026:28157"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477154"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477167"
}
],
"schema_version": "1.7.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Important: python3.14-urllib3 security update",
"upstream": [
"CVE-2026-44431",
"CVE-2026-44432"
]
}
rlsa-2026:28158
Vulnerability from osv_rocky
Published
2026-06-24 12:03
Modified
2026-07-08 12:08
Summary
Important: python-urllib3 security update
Details
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.
Security Fix(es):
-
urllib3: urllib3: Denial of Service due to excessive HTTP response decompression (CVE-2026-44432)
-
urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers (CVE-2026-44431)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Severity
7.5 (High)
Credits
Rocky Enterprise Software Foundation
Red Hat
References
{
"affected": [
{
"package": {
"ecosystem": "Rocky Linux:9",
"name": "python-urllib3",
"purl": "pkg:rpm/rocky-linux/python-urllib3?distro=rocky-linux-9-x86-64\u0026epoch=0"
},
"ranges": [
{
"database_specific": {
"yum_repository": "BaseOS"
},
"events": [
{
"introduced": "0"
},
{
"fixed": "0:1.26.5-8.el9_8"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"credits": [
{
"name": "Rocky Enterprise Software Foundation"
},
{
"name": "Red Hat"
}
],
"details": "Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.\n\nSecurity Fix(es):\n\n* urllib3: urllib3: Denial of Service due to excessive HTTP response decompression (CVE-2026-44432)\n\n* urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers (CVE-2026-44431)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"id": "RLSA-2026:28158",
"modified": "2026-07-08T12:08:27.491397Z",
"published": "2026-06-24T12:03:32.106524Z",
"references": [
{
"type": "ADVISORY",
"url": "https://errata.rockylinux.org/RLSA-2026:28158"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477154"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477167"
}
],
"schema_version": "1.7.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Important: python-urllib3 security update",
"upstream": [
"CVE-2026-44431",
"CVE-2026-44432"
]
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
Loading…
Loading…