Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2026-4645 (GCVE-0-2026-4645)
Vulnerability from cvelistv5 – Published: 2026-03-23 13:35 – Updated: 2026-03-30 08:01
VLAI?
EPSS
Duplicate of CVE-2026-32287
Show details on NVD website{
"containers": {
"cna": {
"providerMetadata": {
"dateUpdated": "2026-03-30T08:01:39.710Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"rejectedReasons": [
{
"lang": "en",
"value": "Duplicate of CVE-2026-32287"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2026-4645",
"datePublished": "2026-03-23T13:35:22.985Z",
"dateRejected": "2026-03-30T08:01:39.710Z",
"dateReserved": "2026-03-23T12:21:39.096Z",
"dateUpdated": "2026-03-30T08:01:39.710Z",
"state": "REJECTED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2026-4645\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2026-03-23T14:16:36.063\",\"lastModified\":\"2026-03-30T08:16:18.693\",\"vulnStatus\":\"Rejected\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Rejected reason: Duplicate of CVE-2026-32287\"}],\"metrics\":{},\"references\":[]}}",
"vulnrichment": {
"containers": "{\"cna\": {\"rejectedReasons\": [{\"lang\": \"en\", \"value\": \"Duplicate of CVE-2026-32287\"}], \"providerMetadata\": {\"orgId\": \"53f830b8-0a3f-465b-8143-3b8a9948e749\", \"shortName\": \"redhat\", \"dateUpdated\": \"2026-03-30T08:01:39.710Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-4645\", \"assignerOrgId\": \"53f830b8-0a3f-465b-8143-3b8a9948e749\", \"state\": \"REJECTED\", \"assignerShortName\": \"redhat\", \"dateReserved\": \"2026-03-23T12:21:39.096Z\", \"datePublished\": \"2026-03-23T13:35:22.985Z\", \"dateUpdated\": \"2026-03-30T08:01:39.710Z\", \"dateRejected\": \"2026-03-30T08:01:39.710Z\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
MSRC_CVE-2026-4645
Vulnerability from csaf_microsoft - Published: 2026-03-02 00:00 - Updated: 2026-04-08 01:41Summary
Github.com/antchfx/xpath: xpath: denial of service via crafted boolean xpath expressions
Notes
Additional Resources: To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle
Disclaimer: The information provided in the Microsoft Knowledge Base is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.
7.5 (High)
Vendor Fix
1.29.4-22:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade
https://learn.microsoft.com/en-us/azure/azure-lin…
Vendor Fix
1.3.2-30:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade
https://learn.microsoft.com/en-us/azure/azure-lin…
Vendor Fix
1.31.0-17:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade
https://learn.microsoft.com/en-us/azure/azure-lin…
Vendor Fix
1.31.0-16:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade
https://learn.microsoft.com/en-us/azure/azure-lin…
References
| URL | Category | |
|---|---|---|
{
"document": {
"category": "csaf_vex",
"csaf_version": "2.0",
"distribution": {
"text": "Public",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en-US",
"notes": [
{
"category": "general",
"text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
"title": "Additional Resources"
},
{
"category": "legal_disclaimer",
"text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
"title": "Disclaimer"
}
],
"publisher": {
"category": "vendor",
"contact_details": "secure@microsoft.com",
"name": "Microsoft Security Response Center",
"namespace": "https://msrc.microsoft.com"
},
"references": [
{
"category": "self",
"summary": "CVE-2026-4645 Github.com/antchfx/xpath: xpath: denial of service via crafted boolean xpath expressions - VEX",
"url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-4645.json"
},
{
"category": "external",
"summary": "Microsoft Support Lifecycle",
"url": "https://support.microsoft.com/lifecycle"
},
{
"category": "external",
"summary": "Common Vulnerability Scoring System",
"url": "https://www.first.org/cvss"
}
],
"title": "Github.com/antchfx/xpath: xpath: denial of service via crafted boolean xpath expressions",
"tracking": {
"current_release_date": "2026-04-08T01:41:42.000Z",
"generator": {
"date": "2026-04-08T07:12:41.697Z",
"engine": {
"name": "MSRC Generator",
"version": "1.0"
}
},
"id": "msrc_CVE-2026-4645",
"initial_release_date": "2026-03-02T00:00:00.000Z",
"revision_history": [
{
"date": "2026-03-27T01:05:07.000Z",
"legacy_version": "1",
"number": "1",
"summary": "Information published."
},
{
"date": "2026-03-28T01:39:15.000Z",
"legacy_version": "2",
"number": "2",
"summary": "Information published."
},
{
"date": "2026-03-28T14:39:04.000Z",
"legacy_version": "3",
"number": "3",
"summary": "Information published."
},
{
"date": "2026-03-31T14:56:03.000Z",
"legacy_version": "4",
"number": "4",
"summary": "Information published."
},
{
"date": "2026-04-01T01:56:30.000Z",
"legacy_version": "5",
"number": "5",
"summary": "Information published."
},
{
"date": "2026-04-08T01:41:42.000Z",
"legacy_version": "6",
"number": "6",
"summary": "Information published."
}
],
"status": "final",
"version": "6"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "2.0",
"product": {
"name": "CBL Mariner 2.0",
"product_id": "17086"
}
},
{
"category": "product_version",
"name": "3.0",
"product": {
"name": "Azure Linux 3.0",
"product_id": "17084"
}
}
],
"category": "product_name",
"name": "Azure Linux"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003ccbl2 telegraf 1.29.4-21",
"product": {
"name": "\u003ccbl2 telegraf 1.29.4-21",
"product_id": "4"
}
},
{
"category": "product_version",
"name": "cbl2 telegraf 1.29.4-21",
"product": {
"name": "cbl2 telegraf 1.29.4-21",
"product_id": "20951"
}
},
{
"category": "product_version_range",
"name": "\u003cazl3 telegraf 1.31.0-15",
"product": {
"name": "\u003cazl3 telegraf 1.31.0-15",
"product_id": "3"
}
},
{
"category": "product_version",
"name": "azl3 telegraf 1.31.0-15",
"product": {
"name": "azl3 telegraf 1.31.0-15",
"product_id": "20969"
}
},
{
"category": "product_version_range",
"name": "\u003cazl3 telegraf 1.31.0-17",
"product": {
"name": "\u003cazl3 telegraf 1.31.0-17",
"product_id": "1"
}
},
{
"category": "product_version",
"name": "azl3 telegraf 1.31.0-17",
"product": {
"name": "azl3 telegraf 1.31.0-17",
"product_id": "21127"
}
}
],
"category": "product_name",
"name": "telegraf"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003ccbl2 terraform 1.3.2-29",
"product": {
"name": "\u003ccbl2 terraform 1.3.2-29",
"product_id": "2"
}
},
{
"category": "product_version",
"name": "cbl2 terraform 1.3.2-29",
"product": {
"name": "cbl2 terraform 1.3.2-29",
"product_id": "21080"
}
}
],
"category": "product_name",
"name": "terraform"
}
],
"category": "vendor",
"name": "Microsoft"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "\u003ccbl2 telegraf 1.29.4-21 as a component of CBL Mariner 2.0",
"product_id": "17086-4"
},
"product_reference": "4",
"relates_to_product_reference": "17086"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cbl2 telegraf 1.29.4-21 as a component of CBL Mariner 2.0",
"product_id": "20951-17086"
},
"product_reference": "20951",
"relates_to_product_reference": "17086"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "\u003ccbl2 terraform 1.3.2-29 as a component of CBL Mariner 2.0",
"product_id": "17086-2"
},
"product_reference": "2",
"relates_to_product_reference": "17086"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "cbl2 terraform 1.3.2-29 as a component of CBL Mariner 2.0",
"product_id": "21080-17086"
},
"product_reference": "21080",
"relates_to_product_reference": "17086"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "\u003cazl3 telegraf 1.31.0-15 as a component of Azure Linux 3.0",
"product_id": "17084-3"
},
"product_reference": "3",
"relates_to_product_reference": "17084"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "azl3 telegraf 1.31.0-15 as a component of Azure Linux 3.0",
"product_id": "20969-17084"
},
"product_reference": "20969",
"relates_to_product_reference": "17084"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "\u003cazl3 telegraf 1.31.0-17 as a component of Azure Linux 3.0",
"product_id": "17084-1"
},
"product_reference": "1",
"relates_to_product_reference": "17084"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "azl3 telegraf 1.31.0-17 as a component of Azure Linux 3.0",
"product_id": "21127-17084"
},
"product_reference": "21127",
"relates_to_product_reference": "17084"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-4645",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
},
"notes": [
{
"category": "general",
"text": "redhat",
"title": "Assigning CNA"
}
],
"product_status": {
"fixed": [
"20951-17086",
"21080-17086",
"20969-17084",
"21127-17084"
],
"known_affected": [
"17086-4",
"17086-2",
"17084-3",
"17084-1"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-4645 Github.com/antchfx/xpath: xpath: denial of service via crafted boolean xpath expressions - VEX",
"url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-4645.json"
}
],
"remediations": [
{
"category": "vendor_fix",
"date": "2026-03-27T01:05:07.000Z",
"details": "1.29.4-22:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade",
"product_ids": [
"17086-4"
],
"url": "https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"
},
{
"category": "vendor_fix",
"date": "2026-03-27T01:05:07.000Z",
"details": "1.3.2-30:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade",
"product_ids": [
"17086-2"
],
"url": "https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"
},
{
"category": "vendor_fix",
"date": "2026-03-27T01:05:07.000Z",
"details": "1.31.0-17:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade",
"product_ids": [
"17084-3"
],
"url": "https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"
},
{
"category": "vendor_fix",
"date": "2026-03-27T01:05:07.000Z",
"details": "1.31.0-16:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade",
"product_ids": [
"17084-1"
],
"url": "https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"environmentalsScore": 0.0,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"temporalScore": 7.5,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"17086-4",
"17086-2",
"17084-3",
"17084-1"
]
}
],
"title": "Github.com/antchfx/xpath: xpath: denial of service via crafted boolean xpath expressions"
}
]
}
CERTFR-2026-AVI-0376
Vulnerability from certfr_avis - Published: 2026-03-30 - Updated: 2026-03-30
De multiples vulnérabilités ont été découvertes dans les produits Microsoft. Elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Microsoft | CBL Mariner | cbl2 telegraf 1.29.4-21 versions antérieures à 1.29.4-22 | ||
| Microsoft | Azure Linux | azl3 glibc 2.38-18 versions antérieures à 2.38-19 | ||
| Microsoft | Azure Linux | azl3 squid 6.13-3 versions antérieures à 6.13-4 | ||
| Microsoft | Azure Linux | azl3 python-pyasn1 0.4.8-1 versions antérieures à 0.4.8-2 | ||
| Microsoft | Azure Linux | azl3 nginx 1.28.2-1 versions antérieures à 1.28.3-1 | ||
| Microsoft | CBL Mariner | cbl2 ncurses 6.4-3 versions antérieures à 6.4-4 | ||
| Microsoft | Azure Linux | azl3 kernel 6.6.126.1-1 versions antérieures à 6.6.130.1-1 | ||
| Microsoft | Azure Linux | azl3 ncurses 6.4-2 versions antérieures à 6.4-3 | ||
| Microsoft | CBL Mariner | cbl2 terraform 1.3.2-29 versions antérieures à 1.3.2-30 | ||
| Microsoft | Azure Linux | azl3 libsoup 3.4.4-12 versions antérieures à 3.4.4-14 | ||
| Microsoft | Azure Linux | azl3 etcd 3.5.21-1 versions antérieures à 3.5.28-1 |
References
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "cbl2 telegraf 1.29.4-21 versions ant\u00e9rieures \u00e0 1.29.4-22",
"product": {
"name": "CBL Mariner",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "azl3 glibc 2.38-18 versions ant\u00e9rieures \u00e0 2.38-19",
"product": {
"name": "Azure Linux",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "azl3 squid 6.13-3 versions ant\u00e9rieures \u00e0 6.13-4",
"product": {
"name": "Azure Linux",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "azl3 python-pyasn1 0.4.8-1 versions ant\u00e9rieures \u00e0 0.4.8-2",
"product": {
"name": "Azure Linux",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "azl3 nginx 1.28.2-1 versions ant\u00e9rieures \u00e0 1.28.3-1",
"product": {
"name": "Azure Linux",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "cbl2 ncurses 6.4-3 versions ant\u00e9rieures \u00e0 6.4-4",
"product": {
"name": "CBL Mariner",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "azl3 kernel 6.6.126.1-1 versions ant\u00e9rieures \u00e0 6.6.130.1-1",
"product": {
"name": "Azure Linux",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "azl3 ncurses 6.4-2 versions ant\u00e9rieures \u00e0 6.4-3",
"product": {
"name": "Azure Linux",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "cbl2 terraform 1.3.2-29 versions ant\u00e9rieures \u00e0 1.3.2-30",
"product": {
"name": "CBL Mariner",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "azl3 libsoup 3.4.4-12 versions ant\u00e9rieures \u00e0 3.4.4-14",
"product": {
"name": "Azure Linux",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "azl3 etcd 3.5.21-1 versions ant\u00e9rieures \u00e0 3.5.28-1",
"product": {
"name": "Azure Linux",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-23318",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23318"
},
{
"name": "CVE-2026-23368",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23368"
},
{
"name": "CVE-2026-23281",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23281"
},
{
"name": "CVE-2026-32647",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32647"
},
{
"name": "CVE-2026-23269",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23269"
},
{
"name": "CVE-2026-23293",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23293"
},
{
"name": "CVE-2026-23290",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23290"
},
{
"name": "CVE-2026-27651",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27651"
},
{
"name": "CVE-2026-23303",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23303"
},
{
"name": "CVE-2026-27654",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27654"
},
{
"name": "CVE-2026-23340",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23340"
},
{
"name": "CVE-2026-23253",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23253"
},
{
"name": "CVE-2026-33343",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33343"
},
{
"name": "CVE-2026-23271",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23271"
},
{
"name": "CVE-2026-23268",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23268"
},
{
"name": "CVE-2026-23285",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23285"
},
{
"name": "CVE-2026-23304",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23304"
},
{
"name": "CVE-2026-23357",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23357"
},
{
"name": "CVE-2026-4645",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4645"
},
{
"name": "CVE-2026-23324",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23324"
},
{
"name": "CVE-2026-23347",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23347"
},
{
"name": "CVE-2026-28755",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28755"
},
{
"name": "CVE-2026-23317",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23317"
},
{
"name": "CVE-2026-23334",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23334"
},
{
"name": "CVE-2026-23391",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23391"
},
{
"name": "CVE-2026-23319",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23319"
},
{
"name": "CVE-2026-23279",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23279"
},
{
"name": "CVE-2026-23244",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23244"
},
{
"name": "CVE-2026-23246",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23246"
},
{
"name": "CVE-2026-30922",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-30922"
},
{
"name": "CVE-2026-23286",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23286"
},
{
"name": "CVE-2026-23359",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23359"
},
{
"name": "CVE-2026-23298",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23298"
},
{
"name": "CVE-2026-23296",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23296"
},
{
"name": "CVE-2026-23396",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23396"
},
{
"name": "CVE-2026-23370",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23370"
},
{
"name": "CVE-2026-23315",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23315"
},
{
"name": "CVE-2026-23352",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23352"
},
{
"name": "CVE-2026-23367",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23367"
},
{
"name": "CVE-2026-32748",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32748"
},
{
"name": "CVE-2026-23300",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23300"
},
{
"name": "CVE-2026-23379",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23379"
},
{
"name": "CVE-2026-23381",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23381"
},
{
"name": "CVE-2026-23392",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23392"
},
{
"name": "CVE-2026-23245",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23245"
},
{
"name": "CVE-2026-4438",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4438"
},
{
"name": "CVE-2026-23364",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23364"
},
{
"name": "CVE-2026-23274",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23274"
},
{
"name": "CVE-2026-23284",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23284"
},
{
"name": "CVE-2026-23397",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23397"
},
{
"name": "CVE-2026-23343",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23343"
},
{
"name": "CVE-2026-23336",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23336"
},
{
"name": "CVE-2025-69720",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-69720"
},
{
"name": "CVE-2026-23289",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23289"
},
{
"name": "CVE-2026-23292",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23292"
},
{
"name": "CVE-2026-23277",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23277"
},
{
"name": "CVE-2026-4437",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4437"
},
{
"name": "CVE-2026-27784",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27784"
},
{
"name": "CVE-2026-23388",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23388"
},
{
"name": "CVE-2026-28753",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-28753"
},
{
"name": "CVE-2026-33526",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33526"
},
{
"name": "CVE-2026-23310",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23310"
},
{
"name": "CVE-2026-2369",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-2369"
},
{
"name": "CVE-2026-33515",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33515"
},
{
"name": "CVE-2026-23395",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23395"
},
{
"name": "CVE-2026-23100",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23100"
},
{
"name": "CVE-2026-23306",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23306"
},
{
"name": "CVE-2026-33413",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33413"
},
{
"name": "CVE-2026-23291",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23291"
},
{
"name": "CVE-2026-23382",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23382"
},
{
"name": "CVE-2026-23312",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23312"
},
{
"name": "CVE-2026-23365",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23365"
},
{
"name": "CVE-2026-23356",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23356"
},
{
"name": "CVE-2026-23307",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23307"
},
{
"name": "CVE-2026-23398",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23398"
},
{
"name": "CVE-2026-23351",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23351"
},
{
"name": "CVE-2026-23390",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-23390"
}
],
"initial_release_date": "2026-03-30T00:00:00",
"last_revision_date": "2026-03-30T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-0376",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-03-30T00:00:00.000000"
}
],
"risks": [
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Microsoft. Elles permettent \u00e0 un attaquant de provoquer un probl\u00e8me de s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Microsoft",
"vendor_advisories": [
{
"published_at": "2026-03-27",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-32748",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32748"
},
{
"published_at": "2026-03-22",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-4438",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-4438"
},
{
"published_at": "2026-03-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-23347",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23347"
},
{
"published_at": "2026-03-20",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-23268",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23268"
},
{
"published_at": "2026-03-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-23392",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23392"
},
{
"published_at": "2026-03-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-23319",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23319"
},
{
"published_at": "2026-03-20",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-23253",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23253"
},
{
"published_at": "2026-03-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-23296",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23296"
},
{
"published_at": "2026-03-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-23364",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23364"
},
{
"published_at": "2026-03-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-23368",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23368"
},
{
"published_at": "2026-03-27",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-27654",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27654"
},
{
"published_at": "2026-03-21",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-30922",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-30922"
},
{
"published_at": "2026-03-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-23286",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23286"
},
{
"published_at": "2026-03-27",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-23396",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23396"
},
{
"published_at": "2026-03-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-23340",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23340"
},
{
"published_at": "2026-03-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-23324",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23324"
},
{
"published_at": "2026-03-27",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-33515",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33515"
},
{
"published_at": "2026-03-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-23318",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23318"
},
{
"published_at": "2026-03-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-23379",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23379"
},
{
"published_at": "2026-03-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-23317",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23317"
},
{
"published_at": "2026-03-27",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-27784",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27784"
},
{
"published_at": "2026-03-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-23359",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23359"
},
{
"published_at": "2026-03-19",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-23245",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23245"
},
{
"published_at": "2026-03-20",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-23269",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23269"
},
{
"published_at": "2026-03-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-23298",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23298"
},
{
"published_at": "2026-03-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-23304",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23304"
},
{
"published_at": "2026-03-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-23370",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23370"
},
{
"published_at": "2026-03-22",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-23100",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23100"
},
{
"published_at": "2026-03-21",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-23271",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23271"
},
{
"published_at": "2026-03-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-23352",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23352"
},
{
"published_at": "2026-03-28",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-33343",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33343"
},
{
"published_at": "2026-03-22",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-4437",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-4437"
},
{
"published_at": "2026-03-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-23343",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23343"
},
{
"published_at": "2026-03-28",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-33413",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33413"
},
{
"published_at": "2026-03-19",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-23246",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23246"
},
{
"published_at": "2026-03-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-23279",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23279"
},
{
"published_at": "2026-03-19",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-23244",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23244"
},
{
"published_at": "2026-03-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-23367",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23367"
},
{
"published_at": "2026-03-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-23307",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23307"
},
{
"published_at": "2026-03-27",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-23398",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23398"
},
{
"published_at": "2026-03-25",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2025-69720",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-69720"
},
{
"published_at": "2026-03-27",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-28755",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-28755"
},
{
"published_at": "2026-03-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-23300",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23300"
},
{
"published_at": "2026-03-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-23381",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23381"
},
{
"published_at": "2026-03-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-23356",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23356"
},
{
"published_at": "2026-03-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-23351",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23351"
},
{
"published_at": "2026-03-21",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-23277",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23277"
},
{
"published_at": "2026-03-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-23315",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23315"
},
{
"published_at": "2026-03-27",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-4645",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-4645"
},
{
"published_at": "2026-03-27",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-33526",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33526"
},
{
"published_at": "2026-03-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-23382",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23382"
},
{
"published_at": "2026-03-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-23310",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23310"
},
{
"published_at": "2026-03-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-23306",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23306"
},
{
"published_at": "2026-03-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-23336",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23336"
},
{
"published_at": "2026-03-25",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-2369",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-2369"
},
{
"published_at": "2026-03-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-23391",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23391"
},
{
"published_at": "2026-03-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-23290",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23290"
},
{
"published_at": "2026-03-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-23312",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23312"
},
{
"published_at": "2026-03-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-23388",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23388"
},
{
"published_at": "2026-03-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-23390",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23390"
},
{
"published_at": "2026-03-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-23303",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23303"
},
{
"published_at": "2026-03-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-23289",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23289"
},
{
"published_at": "2026-03-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-23293",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23293"
},
{
"published_at": "2026-03-27",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-27651",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27651"
},
{
"published_at": "2026-03-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-23291",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23291"
},
{
"published_at": "2026-03-27",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-28753",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-28753"
},
{
"published_at": "2026-03-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-23334",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23334"
},
{
"published_at": "2026-03-27",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-32647",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32647"
},
{
"published_at": "2026-03-27",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-23397",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23397"
},
{
"published_at": "2026-03-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-23281",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23281"
},
{
"published_at": "2026-03-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-23365",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23365"
},
{
"published_at": "2026-03-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-23285",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23285"
},
{
"published_at": "2026-03-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-23292",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23292"
},
{
"published_at": "2026-03-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-23284",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23284"
},
{
"published_at": "2026-03-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-23395",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23395"
},
{
"published_at": "2026-03-21",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-23274",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23274"
},
{
"published_at": "2026-03-26",
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2026-23357",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23357"
}
]
}
RHSA-2026:9385
Vulnerability from csaf_redhat - Published: 2026-04-21 15:08 - Updated: 2026-05-02 03:27Summary
Red Hat Security Advisory: Red Hat OpenShift distributed tracing platform (Tempo) 3.9.2 release
Severity
Important
Notes
Topic: Red Hat OpenShift distributed tracing platform (Tempo) 3.9.2 has been released
Details: This release of the Red Hat OpenShift distributed tracing platform (Tempo) provides security improvements and bug fixes.
Breaking changes:
* None.
Deprecations:
* None.
Technology Preview features:
* None.
Enhancements:
* None.
Bug fixes:
* gRPC-Go authorization bypass vulnerability fix: Previously, gRPC-Go was vulnerable to an authorization bypass attack. This issue occurred because the HTTP/2 :path pseudo-header was not properly validated. Remote attackers could send raw HTTP/2 frames with a malformed :path that omitted the mandatory leading slash to bypass defined security policies. With this update, gRPC-Go properly validates the :path pseudo-header and rejects malformed requests. As a result, attackers can no longer bypass security policies to gain unauthorized access to services or disclose information. For more information, see https://access.redhat.com/security/cve/cve-2026-33186.
* XPath component fix: Previously, the github.com/antchfx/xpath component did not properly handle certain Boolean XPath expressions. A remote attacker could submit a crafted expression that caused an infinite loop, resulting in 100% CPU utilization and a denial-of-service condition. With this update, the XPath component correctly processes Boolean expressions that evaluate to true. The system no longer enters an infinite loop when handling these expressions. For more information, see https://access.redhat.com/security/cve/cve-2026-4645.
* Go JOSE denial-of-service vulnerability fix: Previously, the Go JOSE library for handling JSON Web Encryption (JWE) objects was vulnerable to a denial-of-service (DoS) attack. This issue occurred because the application failed when decrypting a specially crafted JWE object that specified a key wrapping algorithm but contained an empty encrypted key field. With this update, Go JOSE properly validates the encrypted key field before decryption. As a result, the application no longer crashes when processing malformed JWE objects, and the service remains available to legitimate users. For more information, see https://access.redhat.com/security/cve/cve-2026-34986.
* Lodash _.template function fix: Previously, the lodash _.template function validated the variable option but did not validate options.imports key names. Both options passed values to the same code execution path. An attacker with the ability to control options.imports key names or pollute Object.prototype could exploit this gap to execute arbitrary code. With this update, lodash validates options.imports key names by using the same rules applied to the variable option. The _.template function rejects invalid key names and prevents code injection through this path. For more information, see https://access.redhat.com/security/cve/cve-2026-4800.
* Go crypto/x509 and crypto/tls packages fix: Previously, the Go standard library crypto/x509 and crypto/tls packages did not limit the number of intermediate certificates processed during certificate chain building. An attacker could provide an excessive number of intermediate certificates, causing the system to perform an uncontrolled amount of work and resulting in a denial-of-service condition. With this update, the packages limit the number of intermediate certificates accepted during certificate chain validation. The system rejects certificate chains that exceed this limit. For more information, see https://access.redhat.com/security/cve/cve-2026-32280.
* Go Root.Chmod function fix: Previously, the Root.Chmod function in the Go standard library internal/syscall/unix package had a race condition between checking and modifying a target file. An attacker could replace the target with a symbolic link after the check but before the operation completed, causing the permission change to apply to the linked file instead. This allowed an attacker to bypass directory restrictions and change permissions on unintended files. With this update, the Root.Chmod function prevents this race condition. The function no longer follows symbolic links that replace the target during execution. For more information, see https://access.redhat.com/security/cve/cve-2026-32282.
* Go crypto/x509 package fix: Previously, the Go crypto/x509 package applied excluded DNS constraints to wildcard Subject Alternative Names (SANs) in a case-sensitive manner. An attacker could bypass certificate validation by using a different case in the wildcard SAN than the excluded DNS constraint specified. This allowed the system to accept a malicious certificate that should have been rejected. With this update, the package applies DNS constraints case-insensitively when validating wildcard SANs. Certificate chain verification correctly rejects certificates that match excluded DNS constraints regardless of case. For more information, see https://access.redhat.com/security/cve/cve-2026-33810.
* Go crypto/tls component fix: Previously, the Go crypto/tls component did not re-validate certificates against updated certificate authority (CA) settings during TLS session resumption. If CA settings changed between the initial handshake and a resumed session, the component used the original CA settings. An attacker could exploit this to bypass certificate validation and establish a connection that should have been rejected. With this update, the component validates certificates against the current CA settings during session resumption. Resumed sessions that no longer meet CA requirements are rejected. For more information, see https://access.redhat.com/security/cve/cve-2025-68121.
* jsonparser Delete function fix: Previously, the Delete function in the github.com/buger/jsonparser component did not validate offsets when processing malformed JSON input. A remote attacker could provide crafted JSON data that caused a runtime panic, resulting in a denial-of-service condition. With this update, the Delete function validates offsets before processing. The function handles malformed JSON input as expected. For more information, see https://access.redhat.com/security/cve/cve-2026-32285.
* path-to-regexp component fix: Previously, the path-to-regexp component did not limit the complexity of generated regular expressions. A remote attacker could provide input containing multiple sequential optional groups, causing exponential growth in the generated expression and excessive resource consumption. This resulted in a denial-of-service condition. With this update, the component limits regular expression complexity. Input patterns with sequential optional groups no longer cause excessive resource consumption. For more information, see https://access.redhat.com/security/cve/cve-2026-4926.
* Go net/url.Parse function fix: Previously, the Go net/url.Parse function did not properly validate the host component of URLs containing IP-literals. The function ignored invalid characters preceding IP-literals and accepted URLs that should have been rejected. With this update, the function validates the entire host component. URLs with invalid characters before IP-literals are rejected as malformed. For more information, see https://access.redhat.com/security/cve/cve-2026-25679.
* Go crypto/x509 module fix: Previously, the Go crypto/x509 module did not apply all email address constraints when validating certificates. If a certificate contained multiple email constraints with the same local portion but different domain portions, the module only enforced the last constraint and ignored the others. With this update, the module applies all email address constraints during certificate chain validation. Certificates are validated against every specified email constraint. For more information, see https://access.redhat.com/security/cve/cve-2026-27137.
Known issues:
* Gateway fails to forward OTLP HTTP traffic when receiver TLS is enabled. When Tempo Monolithic is configured with `multitenancy.enabled: true` and `ingestion.otlp.http.tls.enabled: true`, the gateway forwards OTLP HTTP traffic to the Tempo receiver using plain HTTP instead of HTTPS. As a consequence, the connection fails with a `connection reset by peer` error because the receiver expects TLS connections. OTLP gRPC ingestion through the gateway is not affected. Jira issue: https://issues.redhat.com/browse/TRACING-5973.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in the crypto/tls component. This vulnerability occurs during Transport Layer Security (TLS) session resumption when certificate authority (CA) settings are modified between the initial and resumed handshakes. An attacker could exploit this to bypass certificate validation, allowing a client or server to establish a connection that should have been rejected. This could lead to an authentication bypass under specific conditions.
7.4 (High)
Vendor Fix
For details on how to apply this update, refer to:
https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators
https://access.redhat.com/errata/RHSA-2026:9385
A flaw was found in the `github.com/antchfx/xpath` component. A remote attacker could exploit this vulnerability by submitting crafted Boolean XPath expressions that evaluate to true. This can cause an infinite loop in the `logicalQuery.Select` function, leading to 100% CPU utilization and a Denial of Service (DoS) condition for the affected system.
7.5 (High)
Vendor Fix
For details on how to apply this update, refer to:
https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators
https://access.redhat.com/errata/RHSA-2026:9385
Workaround
To mitigate this issue, restrict the processing of untrusted or unvalidated XPath expressions by applications which utilize the `github.com/antchfx/xpath` component. Implement input validation and sanitization for all XPath expressions originating from external or untrusted sources. If possible, configure applications to only process XPath expressions from trusted sources or disable features that allow arbitrary XPath expression evaluation.
A flaw was found in lodash. The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink. Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in. If Object.prototype has been polluted by any other vector, the polluted keys are copied into the imports object and passed to Function().
8.1 (High)
Vendor Fix
For details on how to apply this update, refer to:
https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators
https://access.redhat.com/errata/RHSA-2026:9385
Workaround
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
A flaw was found in path-to-regexp. A remote attacker could exploit this vulnerability by providing specially crafted input that generates a regular expression with multiple sequential optional groups. This leads to an exponential growth in the generated regular expression, causing a Denial of Service (DoS) due to excessive resource consumption.
7.5 (High)
Vendor Fix
For details on how to apply this update, refer to:
https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators
https://access.redhat.com/errata/RHSA-2026:9385
Workaround
To mitigate this vulnerability, limit the use of multiple sequential optional groups in route patterns within applications that use `path-to-regexp`. Additionally, avoid directly passing user-controlled input as route patterns to prevent the generation of maliciously crafted regular expressions.
The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.
7.5 (High)
Vendor Fix
For details on how to apply this update, refer to:
https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators
https://access.redhat.com/errata/RHSA-2026:9385
Workaround
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
A certificate validation flaw has been discovered in the golang crypto/x509 module. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.
7.5 (High)
Vendor Fix
For details on how to apply this update, refer to:
https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators
https://access.redhat.com/errata/RHSA-2026:9385
Workaround
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
A flaw was found in the Go standard library packages `crypto/x509` and `crypto/tls`. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being performed. This can result in a denial of service (DoS) condition, making the affected system or application unavailable to legitimate users.
7.5 (High)
Vendor Fix
For details on how to apply this update, refer to:
https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators
https://access.redhat.com/errata/RHSA-2026:9385
A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the `Root.Chmod` function is replaced with a symbolic link during execution, specifically after `Root.Chmod` checks the target but before acting, the `chmod` operation will be performed on the file the symbolic link points to. This issue can bypass directory restrictions and lead to unauthorized permission changes on the filesystem.
7.8 (High)
Vendor Fix
For details on how to apply this update, refer to:
https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators
https://access.redhat.com/errata/RHSA-2026:9385
Workaround
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
A flaw was found in github.com/buger/jsonparser. The Delete function, when processing malformed JSON input, fails to properly validate offsets. This vulnerability can lead to a negative slice index and a runtime panic, allowing a remote attacker to cause a denial of service (DoS) by providing specially crafted JSON data.
7.5 (High)
Vendor Fix
For details on how to apply this update, refer to:
https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators
https://access.redhat.com/errata/RHSA-2026:9385
Workaround
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.
9.1 (Critical)
Vendor Fix
For details on how to apply this update, refer to:
https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators
https://access.redhat.com/errata/RHSA-2026:9385
Workaround
To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.
A flaw was found in the `crypto/x509` package within Go (golang). When verifying a certificate chain, excluded DNS (Domain Name System) constraints are not correctly applied to wildcard DNS Subject Alternative Names (SANs) if the case of the SAN differs from the constraint. This oversight could allow an attacker to bypass certificate validation, potentially leading to the acceptance of a malicious certificate that should have been rejected. This issue specifically impacts the validation of trusted certificate chains.
8.8 (High)
Vendor Fix
For details on how to apply this update, refer to:
https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators
https://access.redhat.com/errata/RHSA-2026:9385
A flaw was found in Go JOSE, a library for handling JSON Web Encryption (JWE) objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the application can crash. This leads to a denial of service (DoS), making the affected service unavailable to legitimate users.
7.5 (High)
Vendor Fix
For details on how to apply this update, refer to:
https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators
https://access.redhat.com/errata/RHSA-2026:9385
Workaround
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
References
| URL | Category | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat OpenShift distributed tracing platform (Tempo) 3.9.2 has been released",
"title": "Topic"
},
{
"category": "general",
"text": "This release of the Red Hat OpenShift distributed tracing platform (Tempo) provides security improvements and bug fixes.\n\n\nBreaking changes:\n\n* None.\n\n\nDeprecations:\n\n* None.\n\n\nTechnology Preview features:\n\n* None.\n\n\nEnhancements:\n\n* None.\n\n\nBug fixes:\n\n* gRPC-Go authorization bypass vulnerability fix: Previously, gRPC-Go was vulnerable to an authorization bypass attack. This issue occurred because the HTTP/2 :path pseudo-header was not properly validated. Remote attackers could send raw HTTP/2 frames with a malformed :path that omitted the mandatory leading slash to bypass defined security policies. With this update, gRPC-Go properly validates the :path pseudo-header and rejects malformed requests. As a result, attackers can no longer bypass security policies to gain unauthorized access to services or disclose information. For more information, see https://access.redhat.com/security/cve/cve-2026-33186.\n\n* XPath component fix: Previously, the github.com/antchfx/xpath component did not properly handle certain Boolean XPath expressions. A remote attacker could submit a crafted expression that caused an infinite loop, resulting in 100% CPU utilization and a denial-of-service condition. With this update, the XPath component correctly processes Boolean expressions that evaluate to true. The system no longer enters an infinite loop when handling these expressions. For more information, see https://access.redhat.com/security/cve/cve-2026-4645.\n\n* Go JOSE denial-of-service vulnerability fix: Previously, the Go JOSE library for handling JSON Web Encryption (JWE) objects was vulnerable to a denial-of-service (DoS) attack. This issue occurred because the application failed when decrypting a specially crafted JWE object that specified a key wrapping algorithm but contained an empty encrypted key field. With this update, Go JOSE properly validates the encrypted key field before decryption. As a result, the application no longer crashes when processing malformed JWE objects, and the service remains available to legitimate users. For more information, see https://access.redhat.com/security/cve/cve-2026-34986.\n\n* Lodash _.template function fix: Previously, the lodash _.template function validated the variable option but did not validate options.imports key names. Both options passed values to the same code execution path. An attacker with the ability to control options.imports key names or pollute Object.prototype could exploit this gap to execute arbitrary code. With this update, lodash validates options.imports key names by using the same rules applied to the variable option. The _.template function rejects invalid key names and prevents code injection through this path. For more information, see https://access.redhat.com/security/cve/cve-2026-4800.\n\n* Go crypto/x509 and crypto/tls packages fix: Previously, the Go standard library crypto/x509 and crypto/tls packages did not limit the number of intermediate certificates processed during certificate chain building. An attacker could provide an excessive number of intermediate certificates, causing the system to perform an uncontrolled amount of work and resulting in a denial-of-service condition. With this update, the packages limit the number of intermediate certificates accepted during certificate chain validation. The system rejects certificate chains that exceed this limit. For more information, see https://access.redhat.com/security/cve/cve-2026-32280.\n\n* Go Root.Chmod function fix: Previously, the Root.Chmod function in the Go standard library internal/syscall/unix package had a race condition between checking and modifying a target file. An attacker could replace the target with a symbolic link after the check but before the operation completed, causing the permission change to apply to the linked file instead. This allowed an attacker to bypass directory restrictions and change permissions on unintended files. With this update, the Root.Chmod function prevents this race condition. The function no longer follows symbolic links that replace the target during execution. For more information, see https://access.redhat.com/security/cve/cve-2026-32282.\n\n* Go crypto/x509 package fix: Previously, the Go crypto/x509 package applied excluded DNS constraints to wildcard Subject Alternative Names (SANs) in a case-sensitive manner. An attacker could bypass certificate validation by using a different case in the wildcard SAN than the excluded DNS constraint specified. This allowed the system to accept a malicious certificate that should have been rejected. With this update, the package applies DNS constraints case-insensitively when validating wildcard SANs. Certificate chain verification correctly rejects certificates that match excluded DNS constraints regardless of case. For more information, see https://access.redhat.com/security/cve/cve-2026-33810.\n\n* Go crypto/tls component fix: Previously, the Go crypto/tls component did not re-validate certificates against updated certificate authority (CA) settings during TLS session resumption. If CA settings changed between the initial handshake and a resumed session, the component used the original CA settings. An attacker could exploit this to bypass certificate validation and establish a connection that should have been rejected. With this update, the component validates certificates against the current CA settings during session resumption. Resumed sessions that no longer meet CA requirements are rejected. For more information, see https://access.redhat.com/security/cve/cve-2025-68121.\n\n* jsonparser Delete function fix: Previously, the Delete function in the github.com/buger/jsonparser component did not validate offsets when processing malformed JSON input. A remote attacker could provide crafted JSON data that caused a runtime panic, resulting in a denial-of-service condition. With this update, the Delete function validates offsets before processing. The function handles malformed JSON input as expected. For more information, see https://access.redhat.com/security/cve/cve-2026-32285.\n\n* path-to-regexp component fix: Previously, the path-to-regexp component did not limit the complexity of generated regular expressions. A remote attacker could provide input containing multiple sequential optional groups, causing exponential growth in the generated expression and excessive resource consumption. This resulted in a denial-of-service condition. With this update, the component limits regular expression complexity. Input patterns with sequential optional groups no longer cause excessive resource consumption. For more information, see https://access.redhat.com/security/cve/cve-2026-4926.\n\n* Go net/url.Parse function fix: Previously, the Go net/url.Parse function did not properly validate the host component of URLs containing IP-literals. The function ignored invalid characters preceding IP-literals and accepted URLs that should have been rejected. With this update, the function validates the entire host component. URLs with invalid characters before IP-literals are rejected as malformed. For more information, see https://access.redhat.com/security/cve/cve-2026-25679.\n\n* Go crypto/x509 module fix: Previously, the Go crypto/x509 module did not apply all email address constraints when validating certificates. If a certificate contained multiple email constraints with the same local portion but different domain portions, the module only enforced the last constraint and ignored the others. With this update, the module applies all email address constraints during certificate chain validation. Certificates are validated against every specified email constraint. For more information, see https://access.redhat.com/security/cve/cve-2026-27137.\n\n\nKnown issues:\n\n* Gateway fails to forward OTLP HTTP traffic when receiver TLS is enabled. When Tempo Monolithic is configured with `multitenancy.enabled: true` and `ingestion.otlp.http.tls.enabled: true`, the gateway forwards OTLP HTTP traffic to the Tempo receiver using plain HTTP instead of HTTPS. As a consequence, the connection fails with a `connection reset by peer` error because the receiver expects TLS connections. OTLP gRPC ingestion through the gateway is not affected. Jira issue: https://issues.redhat.com/browse/TRACING-5973.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:9385",
"url": "https://access.redhat.com/errata/RHSA-2026:9385"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-68121",
"url": "https://access.redhat.com/security/cve/CVE-2025-68121"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-25679",
"url": "https://access.redhat.com/security/cve/CVE-2026-25679"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-27137",
"url": "https://access.redhat.com/security/cve/CVE-2026-27137"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32280",
"url": "https://access.redhat.com/security/cve/CVE-2026-32280"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32282",
"url": "https://access.redhat.com/security/cve/CVE-2026-32282"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32285",
"url": "https://access.redhat.com/security/cve/CVE-2026-32285"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33186",
"url": "https://access.redhat.com/security/cve/CVE-2026-33186"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33810",
"url": "https://access.redhat.com/security/cve/CVE-2026-33810"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-34986",
"url": "https://access.redhat.com/security/cve/CVE-2026-34986"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-4645",
"url": "https://access.redhat.com/security/cve/CVE-2026-4645"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-4800",
"url": "https://access.redhat.com/security/cve/CVE-2026-4800"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-4926",
"url": "https://access.redhat.com/security/cve/CVE-2026-4926"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/distributed_tracing/distributed-tracing-platform-tempo",
"url": "https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/distributed_tracing/distributed-tracing-platform-tempo"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_9385.json"
}
],
"title": "Red Hat Security Advisory: Red Hat OpenShift distributed tracing platform (Tempo) 3.9.2 release",
"tracking": {
"current_release_date": "2026-05-02T03:27:56+00:00",
"generator": {
"date": "2026-05-02T03:27:56+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.7.7"
}
},
"id": "RHSA-2026:9385",
"initial_release_date": "2026-04-21T15:08:38+00:00",
"revision_history": [
{
"date": "2026-04-21T15:08:38+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-04-21T15:08:49+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-05-02T03:27:56+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat OpenShift distributed tracing 3.9.2",
"product": {
"name": "Red Hat OpenShift distributed tracing 3.9.2",
"product_id": "Red Hat OpenShift distributed tracing 3.9.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openshift_distributed_tracing:3.9::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenShift distributed tracing"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"product": {
"name": "registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"product_id": "registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"product_identification_helper": {
"purl": "pkg:oci/tempo-operator-bundle@sha256%3Ad180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c?arch=amd64\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1776674955"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"product": {
"name": "registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"product_id": "registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"product_identification_helper": {
"purl": "pkg:oci/tempo-gateway-rhel9@sha256%3A61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4?arch=amd64\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1776435643"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"product": {
"name": "registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"product_id": "registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"product_identification_helper": {
"purl": "pkg:oci/tempo-jaeger-query-rhel9@sha256%3A0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8?arch=amd64\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1776435608"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"product": {
"name": "registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"product_id": "registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"product_identification_helper": {
"purl": "pkg:oci/tempo-gateway-opa-rhel9@sha256%3A034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052?arch=amd64\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1776435631"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"product": {
"name": "registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"product_id": "registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"product_identification_helper": {
"purl": "pkg:oci/tempo-rhel9-operator@sha256%3Aa5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299?arch=amd64\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1776435565"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"product": {
"name": "registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"product_id": "registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"product_identification_helper": {
"purl": "pkg:oci/tempo-query-rhel9@sha256%3A1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b?arch=amd64\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1776435613"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64",
"product": {
"name": "registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64",
"product_id": "registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64",
"product_identification_helper": {
"purl": "pkg:oci/tempo-rhel9@sha256%3A9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c?arch=amd64\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1776435680"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"product": {
"name": "registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"product_id": "registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"product_identification_helper": {
"purl": "pkg:oci/tempo-gateway-rhel9@sha256%3Ac939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545?arch=arm64\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1776435643"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"product": {
"name": "registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"product_id": "registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"product_identification_helper": {
"purl": "pkg:oci/tempo-jaeger-query-rhel9@sha256%3A81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af?arch=arm64\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1776435608"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"product": {
"name": "registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"product_id": "registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"product_identification_helper": {
"purl": "pkg:oci/tempo-gateway-opa-rhel9@sha256%3Aa66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43?arch=arm64\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1776435631"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"product": {
"name": "registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"product_id": "registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"product_identification_helper": {
"purl": "pkg:oci/tempo-rhel9-operator@sha256%3A0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540?arch=arm64\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1776435565"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"product": {
"name": "registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"product_id": "registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"product_identification_helper": {
"purl": "pkg:oci/tempo-query-rhel9@sha256%3A3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d?arch=arm64\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1776435613"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"product": {
"name": "registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"product_id": "registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"product_identification_helper": {
"purl": "pkg:oci/tempo-rhel9@sha256%3A53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf?arch=arm64\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1776435680"
}
}
}
],
"category": "architecture",
"name": "arm64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"product": {
"name": "registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"product_id": "registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/tempo-gateway-rhel9@sha256%3A9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613?arch=ppc64le\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1776435643"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"product": {
"name": "registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"product_id": "registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/tempo-jaeger-query-rhel9@sha256%3A15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764?arch=ppc64le\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1776435608"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"product": {
"name": "registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"product_id": "registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/tempo-gateway-opa-rhel9@sha256%3A9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e?arch=ppc64le\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1776435631"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"product": {
"name": "registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"product_id": "registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/tempo-rhel9-operator@sha256%3A1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33?arch=ppc64le\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1776435565"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"product": {
"name": "registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"product_id": "registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/tempo-query-rhel9@sha256%3A820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982?arch=ppc64le\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1776435613"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"product": {
"name": "registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"product_id": "registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/tempo-rhel9@sha256%3A55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4?arch=ppc64le\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1776435680"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"product": {
"name": "registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"product_id": "registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"product_identification_helper": {
"purl": "pkg:oci/tempo-gateway-rhel9@sha256%3A59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30?arch=s390x\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1776435643"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"product": {
"name": "registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"product_id": "registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"product_identification_helper": {
"purl": "pkg:oci/tempo-jaeger-query-rhel9@sha256%3A63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54?arch=s390x\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1776435608"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"product": {
"name": "registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"product_id": "registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"product_identification_helper": {
"purl": "pkg:oci/tempo-gateway-opa-rhel9@sha256%3Ab68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115?arch=s390x\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1776435631"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x",
"product": {
"name": "registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x",
"product_id": "registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x",
"product_identification_helper": {
"purl": "pkg:oci/tempo-rhel9-operator@sha256%3Ac7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910?arch=s390x\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1776435565"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"product": {
"name": "registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"product_id": "registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"product_identification_helper": {
"purl": "pkg:oci/tempo-query-rhel9@sha256%3Aee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d?arch=s390x\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1776435613"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"product": {
"name": "registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"product_id": "registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"product_identification_helper": {
"purl": "pkg:oci/tempo-rhel9@sha256%3A0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987?arch=s390x\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1776435680"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64 as a component of Red Hat OpenShift distributed tracing 3.9.2",
"product_id": "Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64"
},
"product_reference": "registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le as a component of Red Hat OpenShift distributed tracing 3.9.2",
"product_id": "Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le"
},
"product_reference": "registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64 as a component of Red Hat OpenShift distributed tracing 3.9.2",
"product_id": "Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64"
},
"product_reference": "registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x as a component of Red Hat OpenShift distributed tracing 3.9.2",
"product_id": "Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x"
},
"product_reference": "registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x as a component of Red Hat OpenShift distributed tracing 3.9.2",
"product_id": "Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x"
},
"product_reference": "registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64 as a component of Red Hat OpenShift distributed tracing 3.9.2",
"product_id": "Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64"
},
"product_reference": "registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le as a component of Red Hat OpenShift distributed tracing 3.9.2",
"product_id": "Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le"
},
"product_reference": "registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64 as a component of Red Hat OpenShift distributed tracing 3.9.2",
"product_id": "Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64"
},
"product_reference": "registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64 as a component of Red Hat OpenShift distributed tracing 3.9.2",
"product_id": "Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64"
},
"product_reference": "registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le as a component of Red Hat OpenShift distributed tracing 3.9.2",
"product_id": "Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le"
},
"product_reference": "registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x as a component of Red Hat OpenShift distributed tracing 3.9.2",
"product_id": "Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x"
},
"product_reference": "registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64 as a component of Red Hat OpenShift distributed tracing 3.9.2",
"product_id": "Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64"
},
"product_reference": "registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64 as a component of Red Hat OpenShift distributed tracing 3.9.2",
"product_id": "Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64"
},
"product_reference": "registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64 as a component of Red Hat OpenShift distributed tracing 3.9.2",
"product_id": "Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64"
},
"product_reference": "registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64 as a component of Red Hat OpenShift distributed tracing 3.9.2",
"product_id": "Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64"
},
"product_reference": "registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le as a component of Red Hat OpenShift distributed tracing 3.9.2",
"product_id": "Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le"
},
"product_reference": "registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x as a component of Red Hat OpenShift distributed tracing 3.9.2",
"product_id": "Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x"
},
"product_reference": "registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64 as a component of Red Hat OpenShift distributed tracing 3.9.2",
"product_id": "Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64"
},
"product_reference": "registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le as a component of Red Hat OpenShift distributed tracing 3.9.2",
"product_id": "Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le"
},
"product_reference": "registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64 as a component of Red Hat OpenShift distributed tracing 3.9.2",
"product_id": "Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64"
},
"product_reference": "registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x as a component of Red Hat OpenShift distributed tracing 3.9.2",
"product_id": "Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x"
},
"product_reference": "registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x as a component of Red Hat OpenShift distributed tracing 3.9.2",
"product_id": "Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x"
},
"product_reference": "registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64 as a component of Red Hat OpenShift distributed tracing 3.9.2",
"product_id": "Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64"
},
"product_reference": "registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le as a component of Red Hat OpenShift distributed tracing 3.9.2",
"product_id": "Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le"
},
"product_reference": "registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64 as a component of Red Hat OpenShift distributed tracing 3.9.2",
"product_id": "Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
},
"product_reference": "registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.2"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-68121",
"discovery_date": "2026-02-05T18:01:30.086058+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2437111"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the crypto/tls component. This vulnerability occurs during Transport Layer Security (TLS) session resumption when certificate authority (CA) settings are modified between the initial and resumed handshakes. An attacker could exploit this to bypass certificate validation, allowing a client or server to establish a connection that should have been rejected. This could lead to an authentication bypass under specific conditions.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is a moderate flaw because it only occurs under specific conditions, such as TLS session resumption with runtime changes to certificate authority settings. Exploitation is not straightforward and requires a controlled setup. The impact is limited to certificate validation within the same component and does not affect system availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
],
"known_not_affected": [
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-68121"
},
{
"category": "external",
"summary": "RHBZ#2437111",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2437111"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-68121",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-68121"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-68121",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68121"
},
{
"category": "external",
"summary": "https://go.dev/cl/737700",
"url": "https://go.dev/cl/737700"
},
{
"category": "external",
"summary": "https://go.dev/issue/77217",
"url": "https://go.dev/issue/77217"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/K09ubi9FQFk",
"url": "https://groups.google.com/g/golang-announce/c/K09ubi9FQFk"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4337",
"url": "https://pkg.go.dev/vuln/GO-2026-4337"
}
],
"release_date": "2026-02-05T17:48:44.141000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-21T15:08:38+00:00",
"details": "For details on how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:9385"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption"
},
{
"cve": "CVE-2026-4645",
"discovery_date": "2026-03-23T06:02:52.120840+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x"
]
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `github.com/antchfx/xpath` component. A remote attacker could exploit this vulnerability by submitting crafted Boolean XPath expressions that evaluate to true. This can cause an infinite loop in the `logicalQuery.Select` function, leading to 100% CPU utilization and a Denial of Service (DoS) condition for the affected system.",
"title": "Vulnerability description"
},
{
"category": "other",
"text": "A denial of service vulnerability was discovered in `github.com/antchfx/xpath`, with Important severity. Systems processing untrusted XPath expressions are vulnerable to an infinite loop, leading to 100% CPU utilization which would impact normal operations of the system.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
],
"known_not_affected": [
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4645"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4645",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4645"
}
],
"release_date": "2026-03-17T20:58:59+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-21T15:08:38+00:00",
"details": "For details on how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:9385"
},
{
"category": "workaround",
"details": "To mitigate this issue, restrict the processing of untrusted or unvalidated XPath expressions by applications which utilize the `github.com/antchfx/xpath` component. Implement input validation and sanitization for all XPath expressions originating from external or untrusted sources. If possible, configure applications to only process XPath expressions from trusted sources or disable features that allow arbitrary XPath expression evaluation.",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/antchfx/xpath: xpath: Denial of Service via crafted Boolean XPath expressions"
},
{
"cve": "CVE-2026-4800",
"cwe": {
"id": "CWE-94",
"name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
},
"discovery_date": "2026-03-31T20:01:21.918257+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2453496"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in lodash. The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink. Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in. If Object.prototype has been polluted by any other vector, the polluted keys are copied into the imports object and passed to Function().",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "lodash: lodash: Arbitrary code execution via untrusted input in template imports",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "In the context of Red Hat Enterprise Linux, the grafana and grafana-pcp packages execute the affected JavaScript entirely client-side within the user\u0027s browser. Consequently, the attack surface is strictly restricted to the local browser environment.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64"
],
"known_not_affected": [
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4800"
},
{
"category": "external",
"summary": "RHBZ#2453496",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453496"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4800",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4800"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4800",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4800"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"category": "external",
"summary": "https://github.com/advisories/GHSA-35jh-r3h4-6jhm",
"url": "https://github.com/advisories/GHSA-35jh-r3h4-6jhm"
},
{
"category": "external",
"summary": "https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c",
"url": "https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c"
}
],
"release_date": "2026-03-31T19:25:55.987000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-21T15:08:38+00:00",
"details": "For details on how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:9385"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "lodash: lodash: Arbitrary code execution via untrusted input in template imports"
},
{
"cve": "CVE-2026-4926",
"cwe": {
"id": "CWE-1333",
"name": "Inefficient Regular Expression Complexity"
},
"discovery_date": "2026-03-26T20:03:28.427630+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451867"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in path-to-regexp. A remote attacker could exploit this vulnerability by providing specially crafted input that generates a regular expression with multiple sequential optional groups. This leads to an exponential growth in the generated regular expression, causing a Denial of Service (DoS) due to excessive resource consumption.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "path-to-regexp: path-to-regexp: Denial of Service via crafted regular expressions",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in `path-to-regexp` that can lead to a Denial of Service. The vulnerability occurs when specially crafted input containing multiple sequential optional groups is used to generate regular expressions, causing exponential resource consumption.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64"
],
"known_not_affected": [
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4926"
},
{
"category": "external",
"summary": "RHBZ#2451867",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451867"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4926",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4926"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4926",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4926"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
}
],
"release_date": "2026-03-26T18:59:38+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-21T15:08:38+00:00",
"details": "For details on how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:9385"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, limit the use of multiple sequential optional groups in route patterns within applications that use `path-to-regexp`. Additionally, avoid directly passing user-controlled input as route patterns to prevent the generation of maliciously crafted regular expressions.",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "path-to-regexp: path-to-regexp: Denial of Service via crafted regular expressions"
},
{
"cve": "CVE-2026-25679",
"cwe": {
"id": "CWE-1286",
"name": "Improper Validation of Syntactic Correctness of Input"
},
"discovery_date": "2026-03-06T22:02:11.567841+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445356"
}
],
"notes": [
{
"category": "description",
"text": "The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/url: Incorrect parsing of IPv6 host literals in net/url",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
],
"known_not_affected": [
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-25679"
},
{
"category": "external",
"summary": "RHBZ#2445356",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445356"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-25679",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25679"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679"
},
{
"category": "external",
"summary": "https://go.dev/cl/752180",
"url": "https://go.dev/cl/752180"
},
{
"category": "external",
"summary": "https://go.dev/issue/77578",
"url": "https://go.dev/issue/77578"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk",
"url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4601",
"url": "https://pkg.go.dev/vuln/GO-2026-4601"
}
],
"release_date": "2026-03-06T21:28:14.211000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-21T15:08:38+00:00",
"details": "For details on how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:9385"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net/url: Incorrect parsing of IPv6 host literals in net/url"
},
{
"cve": "CVE-2026-27137",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-03-06T22:01:38.859733+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445345"
}
],
"notes": [
{
"category": "description",
"text": "A certificate validation flaw has been discovered in the golang crypto/x509 module. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/x509: Incorrect enforcement of email constraints in crypto/x509",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
],
"known_not_affected": [
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27137"
},
{
"category": "external",
"summary": "RHBZ#2445345",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445345"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27137",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27137"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27137",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27137"
},
{
"category": "external",
"summary": "https://go.dev/cl/752182",
"url": "https://go.dev/cl/752182"
},
{
"category": "external",
"summary": "https://go.dev/issue/77952",
"url": "https://go.dev/issue/77952"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk",
"url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4599",
"url": "https://pkg.go.dev/vuln/GO-2026-4599"
}
],
"release_date": "2026-03-06T21:28:13.748000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-21T15:08:38+00:00",
"details": "For details on how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:9385"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/x509: Incorrect enforcement of email constraints in crypto/x509"
},
{
"cve": "CVE-2026-32280",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-04-08T02:01:19.572351+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456339"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Go standard library packages `crypto/x509` and `crypto/tls`. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being performed. This can result in a denial of service (DoS) condition, making the affected system or application unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
],
"known_not_affected": [
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32280"
},
{
"category": "external",
"summary": "RHBZ#2456339",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456339"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32280",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32280"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32280",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32280"
},
{
"category": "external",
"summary": "https://go.dev/cl/758320",
"url": "https://go.dev/cl/758320"
},
{
"category": "external",
"summary": "https://go.dev/issue/78282",
"url": "https://go.dev/issue/78282"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4947",
"url": "https://pkg.go.dev/vuln/GO-2026-4947"
}
],
"release_date": "2026-04-08T01:06:58.595000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-21T15:08:38+00:00",
"details": "For details on how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:9385"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building"
},
{
"cve": "CVE-2026-32282",
"cwe": {
"id": "CWE-367",
"name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
},
"discovery_date": "2026-04-08T02:01:12.683211+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456336"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the `Root.Chmod` function is replaced with a symbolic link during execution, specifically after `Root.Chmod` checks the target but before acting, the `chmod` operation will be performed on the file the symbolic link points to. This issue can bypass directory restrictions and lead to unauthorized permission changes on the filesystem.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs access to the system and the required permissions to create a symbolic link. Additionally, the attacker must swap the target file with a symbolic link in the exact window after the `Root.Chmod` function checks its target but before acting. Due to these conditions, this flaw has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
],
"known_not_affected": [
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32282"
},
{
"category": "external",
"summary": "RHBZ#2456336",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456336"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32282",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32282"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32282",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32282"
},
{
"category": "external",
"summary": "https://go.dev/cl/763761",
"url": "https://go.dev/cl/763761"
},
{
"category": "external",
"summary": "https://go.dev/issue/78293",
"url": "https://go.dev/issue/78293"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4864",
"url": "https://pkg.go.dev/vuln/GO-2026-4864"
}
],
"release_date": "2026-04-08T01:06:55.953000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-21T15:08:38+00:00",
"details": "For details on how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:9385"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root"
},
{
"cve": "CVE-2026-32285",
"cwe": {
"id": "CWE-1285",
"name": "Improper Validation of Specified Index, Position, or Offset in Input"
},
"discovery_date": "2026-03-26T20:01:54.925687+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451846"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in github.com/buger/jsonparser. The Delete function, when processing malformed JSON input, fails to properly validate offsets. This vulnerability can lead to a negative slice index and a runtime panic, allowing a remote attacker to cause a denial of service (DoS) by providing specially crafted JSON data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/buger/jsonparser: github.com/buger/jsonparser: Denial of Service via malformed JSON input",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
],
"known_not_affected": [
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32285"
},
{
"category": "external",
"summary": "RHBZ#2451846",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451846"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32285",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32285"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32285",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32285"
},
{
"category": "external",
"summary": "https://github.com/buger/jsonparser/issues/275",
"url": "https://github.com/buger/jsonparser/issues/275"
},
{
"category": "external",
"summary": "https://github.com/golang/vulndb/issues/4514",
"url": "https://github.com/golang/vulndb/issues/4514"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4514",
"url": "https://pkg.go.dev/vuln/GO-2026-4514"
}
],
"release_date": "2026-03-26T19:40:51.837000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-21T15:08:38+00:00",
"details": "For details on how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:9385"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/buger/jsonparser: github.com/buger/jsonparser: Denial of Service via malformed JSON input"
},
{
"cve": "CVE-2026-33186",
"cwe": {
"id": "CWE-551",
"name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
},
"discovery_date": "2026-03-20T23:02:27.802640+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2449833"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
],
"known_not_affected": [
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33186"
},
{
"category": "external",
"summary": "RHBZ#2449833",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449833"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33186",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33186"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186"
},
{
"category": "external",
"summary": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3",
"url": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3"
}
],
"release_date": "2026-03-20T22:23:32.147000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-21T15:08:38+00:00",
"details": "For details on how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:9385"
},
{
"category": "workaround",
"details": "To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation"
},
{
"cve": "CVE-2026-33810",
"cwe": {
"id": "CWE-1289",
"name": "Improper Validation of Unsafe Equivalence in Input"
},
"discovery_date": "2026-04-08T02:01:09.100830+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456335"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `crypto/x509` package within Go (golang). When verifying a certificate chain, excluded DNS (Domain Name System) constraints are not correctly applied to wildcard DNS Subject Alternative Names (SANs) if the case of the SAN differs from the constraint. This oversight could allow an attacker to bypass certificate validation, potentially leading to the acceptance of a malicious certificate that should have been rejected. This issue specifically impacts the validation of trusted certificate chains.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
],
"known_not_affected": [
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33810"
},
{
"category": "external",
"summary": "RHBZ#2456335",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456335"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33810",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33810"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33810",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33810"
},
{
"category": "external",
"summary": "https://go.dev/cl/763763",
"url": "https://go.dev/cl/763763"
},
{
"category": "external",
"summary": "https://go.dev/issue/78332",
"url": "https://go.dev/issue/78332"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4866",
"url": "https://pkg.go.dev/vuln/GO-2026-4866"
}
],
"release_date": "2026-04-08T01:06:56.546000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-21T15:08:38+00:00",
"details": "For details on how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:9385"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application"
},
{
"cve": "CVE-2026-34986",
"cwe": {
"id": "CWE-131",
"name": "Incorrect Calculation of Buffer Size"
},
"discovery_date": "2026-04-06T17:01:34.639203+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2455470"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Go JOSE, a library for handling JSON Web Encryption (JWE) objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the application can crash. This leads to a denial of service (DoS), making the affected service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
],
"known_not_affected": [
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-34986"
},
{
"category": "external",
"summary": "RHBZ#2455470",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455470"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-34986",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34986"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34986",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34986"
},
{
"category": "external",
"summary": "https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8",
"url": "https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants",
"url": "https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants"
}
],
"release_date": "2026-04-06T16:22:45.353000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-21T15:08:38+00:00",
"details": "For details on how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:9385"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:034af4f19268a6ae63aa7f49ca70f0d1c0311fd269a3bdd79f337260c89ac052_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:9012c42fbb769f3e186bb9ade5f5a044a38e0db7336648050def9fb2f0057c9e_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a66154755c86d821035cf83c940401ddc2a8d45b395f3a36d58f5755de621e43_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:b68e6b2f84171b46ba16b1a2e1d4e4624faacc09453cf14ca68e319e9c8b7115_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:59b7e5bd9dfbf299d3fb92747eccc89a0ac546939f0496deb0cbd418b016be30_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:61eacd3b26e3d12166e61a3cabe2137fb074f245ded11e1f745bb74839f077d4_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9f8e4d6c9e6784baf45513552e8be6487d30d93679043519958b6cc47255b613_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:c939c718084a9f1cff2bb56f932398c58ee3968834ff31ce85c4d356423b6545_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:0205c0565948891a128ed9b6d639582b20cc50123ad22a8cbbf414d4843f2fe8_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:15db63cb743ea84e1acc3d668543233b4bd566c73dc0f033ae8b43390f324764_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:63a9b773e467978769c428a538c8d75c28bfe52e069ac17d269fb7b3c5ad7f54_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:81a49b0518d578de0f8fafdb50cc844e1f6dbf1241d7a10856b8ae810fd873af_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:d180bac53d873bba131cedd40db06cd784d8dc4795d9bff85a6b33921cc1dd9c_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1c4fa975d38a317a307967887524df0c7c3117a91452730978de55a70b41153b_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:3afa5f0d4f74e4d74a74ae9f2ed1c9cdd817473f3ae074de269af9625b77643d_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:820a6bdb3262f1350e06af22121ba6d454908ac6747fa64d768226e6ff77d982_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ee7da439cd21c32b1bc419de7e6d00b13d755a7b360dfea2ff882f9b1a25aa9d_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0a70a38b8b349197a0bd807e226803976c23fda03683f3d63b0687b9bd45d540_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:1dec0c1cd978d3f260d99133ac942a88e255708197f5ded6594db00082357d33_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a5befd5575eebc08f0c6ec8b928f8b5c286ebb3d2dfcdbcb0cdd696b54335299_amd64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c7ae36b9d4c9bfb0750bdb7e9d7b897940ab5149eb670b44c1fe9b1ca7688910_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:0925a2af960b4714614d3f73a14b7a2a04de655cfcedbdd843c06ea5872d1987_s390x",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:53621f808c45a6c8aec0d2df240106a41b1f48c59bb3db648d3d20bb03cb92cf_arm64",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:55635b179e701a58643a4ffc148d75ed2d1e82a383783812484e3da9b7bedaf4_ppc64le",
"Red Hat OpenShift distributed tracing 3.9.2:registry.redhat.io/rhosdt/tempo-rhel9@sha256:9a0a8a33df8e58e391d28fae62e06378c4f3c26e4d81532d38728632698f637c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object"
}
]
}
RHSA-2026:8433
Vulnerability from csaf_redhat - Published: 2026-04-16 10:06 - Updated: 2026-05-03 03:25Summary
Red Hat Security Advisory: OpenShift Compliance Operator bug fix and enhancement update
Severity
Important
Notes
Topic: An updated OpenShift Compliance Operator image that fixes various bugs and adds new
enhancements is now available for the Red Hat OpenShift Enterprise 4 catalog.
Details: The OpenShift Compliance Operator v1.9.0 is now available.
See the documentation for bug fix information:
https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/security_and_compliance/compliance-operator#compliance-operator-release-notes
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in runc. This attack is a more sophisticated variant of CVE-2019-16884, which was a flaw that allowed an attacker to trick runc into writing the LSM process labels for a container process into a dummy tmpfs file and thus not apply the correct LSM labels to the container process. The mitigation applied for CVE-2019-16884 was fairly limited and effectively only caused runc to verify that when we write LSM labels that those labels are actual procfs files.
8.2 (High)
Vendor Fix
Before applying this update, make sure all previously released errata relevant to your
system have been applied. For details on how to apply this update, refer to:
https://docs.openshift.com/container-platform/latest/updating/updating_a_cluster/updating-cluster-cli.html
https://access.redhat.com/errata/RHSA-2026:8433
Workaround
Potential mitigations for this issue include:
* Using rootless containers, as doing so will block most of the inadvertent writes (runc would run with reduced privileges, making attempts to write to procfs files ineffective).
* Based on our analysis, neither AppArmor or SELinux can protect against the full version of the redirected write attack. The container runtime is generally privileged enough to write to arbitrary procfs files, which is more than sufficient to cause a container breakout.
A flaw was found in the net/url package in the Go standard library. The package does not enforce a limit on the number of unique query parameters it parses. A Go application using the net/http.Request.ParseForm method will try to process all parameters provided in the request. A specially crafted HTTP request containing a massive number of query parameters will cause the application to consume an excessive amount of memory, eventually causing the application to crash or become unresponsive, resulting in a denial of service.
7.5 (High)
Vendor Fix
Before applying this update, make sure all previously released errata relevant to your
system have been applied. For details on how to apply this update, refer to:
https://docs.openshift.com/container-platform/latest/updating/updating_a_cluster/updating-cluster-cli.html
https://access.redhat.com/errata/RHSA-2026:8433
Workaround
Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.
A flaw was found in golang. A remote attacker could exploit this vulnerability by providing a specially crafted certificate during the error string construction process within the `HostnameError.Error()` function. This flaw, caused by unbounded string concatenation, leads to excessive resource consumption. Successful exploitation can result in a denial of service (DoS) for the affected system.
7.5 (High)
Vendor Fix
Before applying this update, make sure all previously released errata relevant to your
system have been applied. For details on how to apply this update, refer to:
https://docs.openshift.com/container-platform/latest/updating/updating_a_cluster/updating-cluster-cli.html
https://access.redhat.com/errata/RHSA-2026:8433
A flaw was found in the crypto/tls component. This vulnerability occurs during Transport Layer Security (TLS) session resumption when certificate authority (CA) settings are modified between the initial and resumed handshakes. An attacker could exploit this to bypass certificate validation, allowing a client or server to establish a connection that should have been rejected. This could lead to an authentication bypass under specific conditions.
7.4 (High)
Vendor Fix
Before applying this update, make sure all previously released errata relevant to your
system have been applied. For details on how to apply this update, refer to:
https://docs.openshift.com/container-platform/latest/updating/updating_a_cluster/updating-cluster-cli.html
https://access.redhat.com/errata/RHSA-2026:8433
A flaw was found in the `github.com/antchfx/xpath` component. A remote attacker could exploit this vulnerability by submitting crafted Boolean XPath expressions that evaluate to true. This can cause an infinite loop in the `logicalQuery.Select` function, leading to 100% CPU utilization and a Denial of Service (DoS) condition for the affected system.
7.5 (High)
Vendor Fix
Before applying this update, make sure all previously released errata relevant to your
system have been applied. For details on how to apply this update, refer to:
https://docs.openshift.com/container-platform/latest/updating/updating_a_cluster/updating-cluster-cli.html
https://access.redhat.com/errata/RHSA-2026:8433
Workaround
To mitigate this issue, restrict the processing of untrusted or unvalidated XPath expressions by applications which utilize the `github.com/antchfx/xpath` component. Implement input validation and sanitization for all XPath expressions originating from external or untrusted sources. If possible, configure applications to only process XPath expressions from trusted sources or disable features that allow arbitrary XPath expression evaluation.
The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.
7.5 (High)
Vendor Fix
Before applying this update, make sure all previously released errata relevant to your
system have been applied. For details on how to apply this update, refer to:
https://docs.openshift.com/container-platform/latest/updating/updating_a_cluster/updating-cluster-cli.html
https://access.redhat.com/errata/RHSA-2026:8433
Workaround
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.
9.1 (Critical)
Vendor Fix
Before applying this update, make sure all previously released errata relevant to your
system have been applied. For details on how to apply this update, refer to:
https://docs.openshift.com/container-platform/latest/updating/updating_a_cluster/updating-cluster-cli.html
https://access.redhat.com/errata/RHSA-2026:8433
Workaround
To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.
References
| URL | Category | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An updated OpenShift Compliance Operator image that fixes various bugs and adds new\nenhancements is now available for the Red Hat OpenShift Enterprise 4 catalog.",
"title": "Topic"
},
{
"category": "general",
"text": "The OpenShift Compliance Operator v1.9.0 is now available.\nSee the documentation for bug fix information:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/security_and_compliance/compliance-operator#compliance-operator-release-notes",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:8433",
"url": "https://access.redhat.com/errata/RHSA-2026:8433"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-52881",
"url": "https://access.redhat.com/security/cve/CVE-2025-52881"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-61726",
"url": "https://access.redhat.com/security/cve/CVE-2025-61726"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-61729",
"url": "https://access.redhat.com/security/cve/CVE-2025-61729"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-68121",
"url": "https://access.redhat.com/security/cve/CVE-2025-68121"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-25679",
"url": "https://access.redhat.com/security/cve/CVE-2026-25679"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33186",
"url": "https://access.redhat.com/security/cve/CVE-2026-33186"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-4645",
"url": "https://access.redhat.com/security/cve/CVE-2026-4645"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_8433.json"
}
],
"title": "Red Hat Security Advisory: OpenShift Compliance Operator bug fix and enhancement update",
"tracking": {
"current_release_date": "2026-05-03T03:25:55+00:00",
"generator": {
"date": "2026-05-03T03:25:55+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.7.7"
}
},
"id": "RHSA-2026:8433",
"initial_release_date": "2026-04-16T10:06:55+00:00",
"revision_history": [
{
"date": "2026-04-16T10:06:55+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-04-16T10:07:01+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-05-03T03:25:55+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "OpenShift Compliance Operator 1",
"product": {
"name": "OpenShift Compliance Operator 1",
"product_id": "OpenShift Compliance Operator 1",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openshift_compliance_operator:1::el9"
}
}
}
],
"category": "product_family",
"name": "OpenShift Compliance Operator"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:e2cbcab60fad0718e63a8c9bacaca97d205735e968505a56ae1a1c523d5ee2da_amd64",
"product": {
"name": "registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:e2cbcab60fad0718e63a8c9bacaca97d205735e968505a56ae1a1c523d5ee2da_amd64",
"product_id": "registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:e2cbcab60fad0718e63a8c9bacaca97d205735e968505a56ae1a1c523d5ee2da_amd64",
"product_identification_helper": {
"purl": "pkg:oci/openshift-compliance-operator-bundle@sha256%3Ae2cbcab60fad0718e63a8c9bacaca97d205735e968505a56ae1a1c523d5ee2da?arch=amd64\u0026repository_url=registry.redhat.io/compliance\u0026tag=1776237332"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:5050558c5b76a544f8785a8ee6e153aaa1c4649e2ec897a1728d71c360ef9175_amd64",
"product": {
"name": "registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:5050558c5b76a544f8785a8ee6e153aaa1c4649e2ec897a1728d71c360ef9175_amd64",
"product_id": "registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:5050558c5b76a544f8785a8ee6e153aaa1c4649e2ec897a1728d71c360ef9175_amd64",
"product_identification_helper": {
"purl": "pkg:oci/openshift-compliance-content-rhel8@sha256%3A5050558c5b76a544f8785a8ee6e153aaa1c4649e2ec897a1728d71c360ef9175?arch=amd64\u0026repository_url=registry.redhat.io/compliance\u0026tag=1776170256"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b6778248c42c242c05accfbebbda445cb48d85484ea7011744f5b0bb32c56a40_amd64",
"product": {
"name": "registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b6778248c42c242c05accfbebbda445cb48d85484ea7011744f5b0bb32c56a40_amd64",
"product_id": "registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b6778248c42c242c05accfbebbda445cb48d85484ea7011744f5b0bb32c56a40_amd64",
"product_identification_helper": {
"purl": "pkg:oci/openshift-compliance-must-gather-rhel8@sha256%3Ab6778248c42c242c05accfbebbda445cb48d85484ea7011744f5b0bb32c56a40?arch=amd64\u0026repository_url=registry.redhat.io/compliance\u0026tag=1775641344"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:9281889838e4c68f688024b27b4fb5e95b461ae63518533d08d06a5d3b499bed_amd64",
"product": {
"name": "registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:9281889838e4c68f688024b27b4fb5e95b461ae63518533d08d06a5d3b499bed_amd64",
"product_id": "registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:9281889838e4c68f688024b27b4fb5e95b461ae63518533d08d06a5d3b499bed_amd64",
"product_identification_helper": {
"purl": "pkg:oci/openshift-compliance-openscap-rhel8@sha256%3A9281889838e4c68f688024b27b4fb5e95b461ae63518533d08d06a5d3b499bed?arch=amd64\u0026repository_url=registry.redhat.io/compliance\u0026tag=1775641480"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:45059c429a74ea709c828dcdcf0eeb481ec0c27ec82fa4c7f6a46214749e6edb_amd64",
"product": {
"name": "registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:45059c429a74ea709c828dcdcf0eeb481ec0c27ec82fa4c7f6a46214749e6edb_amd64",
"product_id": "registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:45059c429a74ea709c828dcdcf0eeb481ec0c27ec82fa4c7f6a46214749e6edb_amd64",
"product_identification_helper": {
"purl": "pkg:oci/openshift-compliance-rhel8-operator@sha256%3A45059c429a74ea709c828dcdcf0eeb481ec0c27ec82fa4c7f6a46214749e6edb?arch=amd64\u0026repository_url=registry.redhat.io/compliance\u0026tag=1776235578"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:59335016a17f8557d8286926c3e738830683bf5bc8dea298ab0420e85b85d089_arm64",
"product": {
"name": "registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:59335016a17f8557d8286926c3e738830683bf5bc8dea298ab0420e85b85d089_arm64",
"product_id": "registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:59335016a17f8557d8286926c3e738830683bf5bc8dea298ab0420e85b85d089_arm64",
"product_identification_helper": {
"purl": "pkg:oci/openshift-compliance-content-rhel8@sha256%3A59335016a17f8557d8286926c3e738830683bf5bc8dea298ab0420e85b85d089?arch=arm64\u0026repository_url=registry.redhat.io/compliance\u0026tag=1776170256"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:25a97ab36e361a6b9cb2a5621241d56b4b420d6a2e50a112fc209b09484abbbb_arm64",
"product": {
"name": "registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:25a97ab36e361a6b9cb2a5621241d56b4b420d6a2e50a112fc209b09484abbbb_arm64",
"product_id": "registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:25a97ab36e361a6b9cb2a5621241d56b4b420d6a2e50a112fc209b09484abbbb_arm64",
"product_identification_helper": {
"purl": "pkg:oci/openshift-compliance-must-gather-rhel8@sha256%3A25a97ab36e361a6b9cb2a5621241d56b4b420d6a2e50a112fc209b09484abbbb?arch=arm64\u0026repository_url=registry.redhat.io/compliance\u0026tag=1775641344"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:ee47b302b5655b1a64d79ce370033956c14cfacd83b3f589f4eb153cc9201d62_arm64",
"product": {
"name": "registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:ee47b302b5655b1a64d79ce370033956c14cfacd83b3f589f4eb153cc9201d62_arm64",
"product_id": "registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:ee47b302b5655b1a64d79ce370033956c14cfacd83b3f589f4eb153cc9201d62_arm64",
"product_identification_helper": {
"purl": "pkg:oci/openshift-compliance-openscap-rhel8@sha256%3Aee47b302b5655b1a64d79ce370033956c14cfacd83b3f589f4eb153cc9201d62?arch=arm64\u0026repository_url=registry.redhat.io/compliance\u0026tag=1775641480"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:ff3573bf04e5f74c9aa62f96c349cbe3599f7623a05acc1881eb321ee5d93487_arm64",
"product": {
"name": "registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:ff3573bf04e5f74c9aa62f96c349cbe3599f7623a05acc1881eb321ee5d93487_arm64",
"product_id": "registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:ff3573bf04e5f74c9aa62f96c349cbe3599f7623a05acc1881eb321ee5d93487_arm64",
"product_identification_helper": {
"purl": "pkg:oci/openshift-compliance-rhel8-operator@sha256%3Aff3573bf04e5f74c9aa62f96c349cbe3599f7623a05acc1881eb321ee5d93487?arch=arm64\u0026repository_url=registry.redhat.io/compliance\u0026tag=1776235578"
}
}
}
],
"category": "architecture",
"name": "arm64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:a80ae4926abc8df9fb976f47911662aa5db8b4beed60efa37e94b1bc36a152c8_ppc64le",
"product": {
"name": "registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:a80ae4926abc8df9fb976f47911662aa5db8b4beed60efa37e94b1bc36a152c8_ppc64le",
"product_id": "registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:a80ae4926abc8df9fb976f47911662aa5db8b4beed60efa37e94b1bc36a152c8_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/openshift-compliance-content-rhel8@sha256%3Aa80ae4926abc8df9fb976f47911662aa5db8b4beed60efa37e94b1bc36a152c8?arch=ppc64le\u0026repository_url=registry.redhat.io/compliance\u0026tag=1776170256"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:55cf2e5dcae568fe3236363993f3987465b78f5f892c7fabcdec2bde63afb4fb_ppc64le",
"product": {
"name": "registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:55cf2e5dcae568fe3236363993f3987465b78f5f892c7fabcdec2bde63afb4fb_ppc64le",
"product_id": "registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:55cf2e5dcae568fe3236363993f3987465b78f5f892c7fabcdec2bde63afb4fb_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/openshift-compliance-must-gather-rhel8@sha256%3A55cf2e5dcae568fe3236363993f3987465b78f5f892c7fabcdec2bde63afb4fb?arch=ppc64le\u0026repository_url=registry.redhat.io/compliance\u0026tag=1775641344"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:62291ebc31aedc55cda270168146cf272856e1e566f75b0694f14e28adeed72c_ppc64le",
"product": {
"name": "registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:62291ebc31aedc55cda270168146cf272856e1e566f75b0694f14e28adeed72c_ppc64le",
"product_id": "registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:62291ebc31aedc55cda270168146cf272856e1e566f75b0694f14e28adeed72c_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/openshift-compliance-openscap-rhel8@sha256%3A62291ebc31aedc55cda270168146cf272856e1e566f75b0694f14e28adeed72c?arch=ppc64le\u0026repository_url=registry.redhat.io/compliance\u0026tag=1775641480"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:f3c1bd5157e6791f150dbe211a5ca4a391e9e69ac07748a41bb0b829e645933a_ppc64le",
"product": {
"name": "registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:f3c1bd5157e6791f150dbe211a5ca4a391e9e69ac07748a41bb0b829e645933a_ppc64le",
"product_id": "registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:f3c1bd5157e6791f150dbe211a5ca4a391e9e69ac07748a41bb0b829e645933a_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/openshift-compliance-rhel8-operator@sha256%3Af3c1bd5157e6791f150dbe211a5ca4a391e9e69ac07748a41bb0b829e645933a?arch=ppc64le\u0026repository_url=registry.redhat.io/compliance\u0026tag=1776235578"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:1fa845b0dfc4fd18b28558aae4e9fb69f220649495fb4e1284da0dc43f5cacac_s390x",
"product": {
"name": "registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:1fa845b0dfc4fd18b28558aae4e9fb69f220649495fb4e1284da0dc43f5cacac_s390x",
"product_id": "registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:1fa845b0dfc4fd18b28558aae4e9fb69f220649495fb4e1284da0dc43f5cacac_s390x",
"product_identification_helper": {
"purl": "pkg:oci/openshift-compliance-content-rhel8@sha256%3A1fa845b0dfc4fd18b28558aae4e9fb69f220649495fb4e1284da0dc43f5cacac?arch=s390x\u0026repository_url=registry.redhat.io/compliance\u0026tag=1776170256"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:2621107d4c7b72f2e6de593355711fa63ed8efc637d1ea17ea8ac1ffb796a139_s390x",
"product": {
"name": "registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:2621107d4c7b72f2e6de593355711fa63ed8efc637d1ea17ea8ac1ffb796a139_s390x",
"product_id": "registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:2621107d4c7b72f2e6de593355711fa63ed8efc637d1ea17ea8ac1ffb796a139_s390x",
"product_identification_helper": {
"purl": "pkg:oci/openshift-compliance-must-gather-rhel8@sha256%3A2621107d4c7b72f2e6de593355711fa63ed8efc637d1ea17ea8ac1ffb796a139?arch=s390x\u0026repository_url=registry.redhat.io/compliance\u0026tag=1775641344"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:e0d72f7dfeda202524e67c5b344af6a6ef64712cd4f04e90ac1e0dffc49addf7_s390x",
"product": {
"name": "registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:e0d72f7dfeda202524e67c5b344af6a6ef64712cd4f04e90ac1e0dffc49addf7_s390x",
"product_id": "registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:e0d72f7dfeda202524e67c5b344af6a6ef64712cd4f04e90ac1e0dffc49addf7_s390x",
"product_identification_helper": {
"purl": "pkg:oci/openshift-compliance-openscap-rhel8@sha256%3Ae0d72f7dfeda202524e67c5b344af6a6ef64712cd4f04e90ac1e0dffc49addf7?arch=s390x\u0026repository_url=registry.redhat.io/compliance\u0026tag=1775641480"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:b1cd378eba90e9258c1639305a8bd66120220333a3cdf2df5ebfb71d1e9d7539_s390x",
"product": {
"name": "registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:b1cd378eba90e9258c1639305a8bd66120220333a3cdf2df5ebfb71d1e9d7539_s390x",
"product_id": "registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:b1cd378eba90e9258c1639305a8bd66120220333a3cdf2df5ebfb71d1e9d7539_s390x",
"product_identification_helper": {
"purl": "pkg:oci/openshift-compliance-rhel8-operator@sha256%3Ab1cd378eba90e9258c1639305a8bd66120220333a3cdf2df5ebfb71d1e9d7539?arch=s390x\u0026repository_url=registry.redhat.io/compliance\u0026tag=1776235578"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:1fa845b0dfc4fd18b28558aae4e9fb69f220649495fb4e1284da0dc43f5cacac_s390x as a component of OpenShift Compliance Operator 1",
"product_id": "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:1fa845b0dfc4fd18b28558aae4e9fb69f220649495fb4e1284da0dc43f5cacac_s390x"
},
"product_reference": "registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:1fa845b0dfc4fd18b28558aae4e9fb69f220649495fb4e1284da0dc43f5cacac_s390x",
"relates_to_product_reference": "OpenShift Compliance Operator 1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:5050558c5b76a544f8785a8ee6e153aaa1c4649e2ec897a1728d71c360ef9175_amd64 as a component of OpenShift Compliance Operator 1",
"product_id": "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:5050558c5b76a544f8785a8ee6e153aaa1c4649e2ec897a1728d71c360ef9175_amd64"
},
"product_reference": "registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:5050558c5b76a544f8785a8ee6e153aaa1c4649e2ec897a1728d71c360ef9175_amd64",
"relates_to_product_reference": "OpenShift Compliance Operator 1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:59335016a17f8557d8286926c3e738830683bf5bc8dea298ab0420e85b85d089_arm64 as a component of OpenShift Compliance Operator 1",
"product_id": "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:59335016a17f8557d8286926c3e738830683bf5bc8dea298ab0420e85b85d089_arm64"
},
"product_reference": "registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:59335016a17f8557d8286926c3e738830683bf5bc8dea298ab0420e85b85d089_arm64",
"relates_to_product_reference": "OpenShift Compliance Operator 1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:a80ae4926abc8df9fb976f47911662aa5db8b4beed60efa37e94b1bc36a152c8_ppc64le as a component of OpenShift Compliance Operator 1",
"product_id": "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:a80ae4926abc8df9fb976f47911662aa5db8b4beed60efa37e94b1bc36a152c8_ppc64le"
},
"product_reference": "registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:a80ae4926abc8df9fb976f47911662aa5db8b4beed60efa37e94b1bc36a152c8_ppc64le",
"relates_to_product_reference": "OpenShift Compliance Operator 1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:25a97ab36e361a6b9cb2a5621241d56b4b420d6a2e50a112fc209b09484abbbb_arm64 as a component of OpenShift Compliance Operator 1",
"product_id": "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:25a97ab36e361a6b9cb2a5621241d56b4b420d6a2e50a112fc209b09484abbbb_arm64"
},
"product_reference": "registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:25a97ab36e361a6b9cb2a5621241d56b4b420d6a2e50a112fc209b09484abbbb_arm64",
"relates_to_product_reference": "OpenShift Compliance Operator 1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:2621107d4c7b72f2e6de593355711fa63ed8efc637d1ea17ea8ac1ffb796a139_s390x as a component of OpenShift Compliance Operator 1",
"product_id": "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:2621107d4c7b72f2e6de593355711fa63ed8efc637d1ea17ea8ac1ffb796a139_s390x"
},
"product_reference": "registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:2621107d4c7b72f2e6de593355711fa63ed8efc637d1ea17ea8ac1ffb796a139_s390x",
"relates_to_product_reference": "OpenShift Compliance Operator 1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:55cf2e5dcae568fe3236363993f3987465b78f5f892c7fabcdec2bde63afb4fb_ppc64le as a component of OpenShift Compliance Operator 1",
"product_id": "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:55cf2e5dcae568fe3236363993f3987465b78f5f892c7fabcdec2bde63afb4fb_ppc64le"
},
"product_reference": "registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:55cf2e5dcae568fe3236363993f3987465b78f5f892c7fabcdec2bde63afb4fb_ppc64le",
"relates_to_product_reference": "OpenShift Compliance Operator 1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b6778248c42c242c05accfbebbda445cb48d85484ea7011744f5b0bb32c56a40_amd64 as a component of OpenShift Compliance Operator 1",
"product_id": "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b6778248c42c242c05accfbebbda445cb48d85484ea7011744f5b0bb32c56a40_amd64"
},
"product_reference": "registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b6778248c42c242c05accfbebbda445cb48d85484ea7011744f5b0bb32c56a40_amd64",
"relates_to_product_reference": "OpenShift Compliance Operator 1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:62291ebc31aedc55cda270168146cf272856e1e566f75b0694f14e28adeed72c_ppc64le as a component of OpenShift Compliance Operator 1",
"product_id": "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:62291ebc31aedc55cda270168146cf272856e1e566f75b0694f14e28adeed72c_ppc64le"
},
"product_reference": "registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:62291ebc31aedc55cda270168146cf272856e1e566f75b0694f14e28adeed72c_ppc64le",
"relates_to_product_reference": "OpenShift Compliance Operator 1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:9281889838e4c68f688024b27b4fb5e95b461ae63518533d08d06a5d3b499bed_amd64 as a component of OpenShift Compliance Operator 1",
"product_id": "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:9281889838e4c68f688024b27b4fb5e95b461ae63518533d08d06a5d3b499bed_amd64"
},
"product_reference": "registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:9281889838e4c68f688024b27b4fb5e95b461ae63518533d08d06a5d3b499bed_amd64",
"relates_to_product_reference": "OpenShift Compliance Operator 1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:e0d72f7dfeda202524e67c5b344af6a6ef64712cd4f04e90ac1e0dffc49addf7_s390x as a component of OpenShift Compliance Operator 1",
"product_id": "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:e0d72f7dfeda202524e67c5b344af6a6ef64712cd4f04e90ac1e0dffc49addf7_s390x"
},
"product_reference": "registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:e0d72f7dfeda202524e67c5b344af6a6ef64712cd4f04e90ac1e0dffc49addf7_s390x",
"relates_to_product_reference": "OpenShift Compliance Operator 1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:ee47b302b5655b1a64d79ce370033956c14cfacd83b3f589f4eb153cc9201d62_arm64 as a component of OpenShift Compliance Operator 1",
"product_id": "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:ee47b302b5655b1a64d79ce370033956c14cfacd83b3f589f4eb153cc9201d62_arm64"
},
"product_reference": "registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:ee47b302b5655b1a64d79ce370033956c14cfacd83b3f589f4eb153cc9201d62_arm64",
"relates_to_product_reference": "OpenShift Compliance Operator 1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:e2cbcab60fad0718e63a8c9bacaca97d205735e968505a56ae1a1c523d5ee2da_amd64 as a component of OpenShift Compliance Operator 1",
"product_id": "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:e2cbcab60fad0718e63a8c9bacaca97d205735e968505a56ae1a1c523d5ee2da_amd64"
},
"product_reference": "registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:e2cbcab60fad0718e63a8c9bacaca97d205735e968505a56ae1a1c523d5ee2da_amd64",
"relates_to_product_reference": "OpenShift Compliance Operator 1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:45059c429a74ea709c828dcdcf0eeb481ec0c27ec82fa4c7f6a46214749e6edb_amd64 as a component of OpenShift Compliance Operator 1",
"product_id": "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:45059c429a74ea709c828dcdcf0eeb481ec0c27ec82fa4c7f6a46214749e6edb_amd64"
},
"product_reference": "registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:45059c429a74ea709c828dcdcf0eeb481ec0c27ec82fa4c7f6a46214749e6edb_amd64",
"relates_to_product_reference": "OpenShift Compliance Operator 1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:b1cd378eba90e9258c1639305a8bd66120220333a3cdf2df5ebfb71d1e9d7539_s390x as a component of OpenShift Compliance Operator 1",
"product_id": "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:b1cd378eba90e9258c1639305a8bd66120220333a3cdf2df5ebfb71d1e9d7539_s390x"
},
"product_reference": "registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:b1cd378eba90e9258c1639305a8bd66120220333a3cdf2df5ebfb71d1e9d7539_s390x",
"relates_to_product_reference": "OpenShift Compliance Operator 1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:f3c1bd5157e6791f150dbe211a5ca4a391e9e69ac07748a41bb0b829e645933a_ppc64le as a component of OpenShift Compliance Operator 1",
"product_id": "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:f3c1bd5157e6791f150dbe211a5ca4a391e9e69ac07748a41bb0b829e645933a_ppc64le"
},
"product_reference": "registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:f3c1bd5157e6791f150dbe211a5ca4a391e9e69ac07748a41bb0b829e645933a_ppc64le",
"relates_to_product_reference": "OpenShift Compliance Operator 1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:ff3573bf04e5f74c9aa62f96c349cbe3599f7623a05acc1881eb321ee5d93487_arm64 as a component of OpenShift Compliance Operator 1",
"product_id": "OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:ff3573bf04e5f74c9aa62f96c349cbe3599f7623a05acc1881eb321ee5d93487_arm64"
},
"product_reference": "registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:ff3573bf04e5f74c9aa62f96c349cbe3599f7623a05acc1881eb321ee5d93487_arm64",
"relates_to_product_reference": "OpenShift Compliance Operator 1"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-52881",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"discovery_date": "2025-10-17T14:19:18.652000+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:1fa845b0dfc4fd18b28558aae4e9fb69f220649495fb4e1284da0dc43f5cacac_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:5050558c5b76a544f8785a8ee6e153aaa1c4649e2ec897a1728d71c360ef9175_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:59335016a17f8557d8286926c3e738830683bf5bc8dea298ab0420e85b85d089_arm64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:a80ae4926abc8df9fb976f47911662aa5db8b4beed60efa37e94b1bc36a152c8_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:62291ebc31aedc55cda270168146cf272856e1e566f75b0694f14e28adeed72c_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:9281889838e4c68f688024b27b4fb5e95b461ae63518533d08d06a5d3b499bed_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:e0d72f7dfeda202524e67c5b344af6a6ef64712cd4f04e90ac1e0dffc49addf7_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:ee47b302b5655b1a64d79ce370033956c14cfacd83b3f589f4eb153cc9201d62_arm64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:e2cbcab60fad0718e63a8c9bacaca97d205735e968505a56ae1a1c523d5ee2da_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:45059c429a74ea709c828dcdcf0eeb481ec0c27ec82fa4c7f6a46214749e6edb_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:b1cd378eba90e9258c1639305a8bd66120220333a3cdf2df5ebfb71d1e9d7539_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:f3c1bd5157e6791f150dbe211a5ca4a391e9e69ac07748a41bb0b829e645933a_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:ff3573bf04e5f74c9aa62f96c349cbe3599f7623a05acc1881eb321ee5d93487_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2404715"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in runc. This attack is a more sophisticated variant of CVE-2019-16884, which was a flaw that allowed an attacker to trick runc into writing the LSM process labels for a container process into a dummy tmpfs file and thus not apply the correct LSM labels to the container process. The mitigation applied for CVE-2019-16884 was fairly limited and effectively only caused runc to verify that when we write LSM labels that those labels are actual procfs files.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "runc: opencontainers/selinux: container escape and denial of service due to arbitrary write gadgets and procfs write redirects",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat considers this as an Important flaw since the impact is limited to local attack with minimal privileges in order to jeopardize the environment.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:25a97ab36e361a6b9cb2a5621241d56b4b420d6a2e50a112fc209b09484abbbb_arm64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:2621107d4c7b72f2e6de593355711fa63ed8efc637d1ea17ea8ac1ffb796a139_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:55cf2e5dcae568fe3236363993f3987465b78f5f892c7fabcdec2bde63afb4fb_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b6778248c42c242c05accfbebbda445cb48d85484ea7011744f5b0bb32c56a40_amd64"
],
"known_not_affected": [
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:1fa845b0dfc4fd18b28558aae4e9fb69f220649495fb4e1284da0dc43f5cacac_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:5050558c5b76a544f8785a8ee6e153aaa1c4649e2ec897a1728d71c360ef9175_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:59335016a17f8557d8286926c3e738830683bf5bc8dea298ab0420e85b85d089_arm64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:a80ae4926abc8df9fb976f47911662aa5db8b4beed60efa37e94b1bc36a152c8_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:62291ebc31aedc55cda270168146cf272856e1e566f75b0694f14e28adeed72c_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:9281889838e4c68f688024b27b4fb5e95b461ae63518533d08d06a5d3b499bed_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:e0d72f7dfeda202524e67c5b344af6a6ef64712cd4f04e90ac1e0dffc49addf7_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:ee47b302b5655b1a64d79ce370033956c14cfacd83b3f589f4eb153cc9201d62_arm64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:e2cbcab60fad0718e63a8c9bacaca97d205735e968505a56ae1a1c523d5ee2da_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:45059c429a74ea709c828dcdcf0eeb481ec0c27ec82fa4c7f6a46214749e6edb_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:b1cd378eba90e9258c1639305a8bd66120220333a3cdf2df5ebfb71d1e9d7539_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:f3c1bd5157e6791f150dbe211a5ca4a391e9e69ac07748a41bb0b829e645933a_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:ff3573bf04e5f74c9aa62f96c349cbe3599f7623a05acc1881eb321ee5d93487_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-52881"
},
{
"category": "external",
"summary": "RHBZ#2404715",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2404715"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-52881",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-52881"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-52881",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52881"
},
{
"category": "external",
"summary": "https://github.com/opencontainers/runc/security/advisories/GHSA-cgrx-mc8f-2prm",
"url": "https://github.com/opencontainers/runc/security/advisories/GHSA-cgrx-mc8f-2prm"
},
{
"category": "external",
"summary": "https://github.com/opencontainers/selinux/pull/237",
"url": "https://github.com/opencontainers/selinux/pull/237"
}
],
"release_date": "2025-11-05T09:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T10:06:55+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your\nsystem have been applied. For details on how to apply this update, refer to:\n \nhttps://docs.openshift.com/container-platform/latest/updating/updating_a_cluster/updating-cluster-cli.html",
"product_ids": [
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:25a97ab36e361a6b9cb2a5621241d56b4b420d6a2e50a112fc209b09484abbbb_arm64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:2621107d4c7b72f2e6de593355711fa63ed8efc637d1ea17ea8ac1ffb796a139_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:55cf2e5dcae568fe3236363993f3987465b78f5f892c7fabcdec2bde63afb4fb_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b6778248c42c242c05accfbebbda445cb48d85484ea7011744f5b0bb32c56a40_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8433"
},
{
"category": "workaround",
"details": "Potential mitigations for this issue include:\n\n* Using rootless containers, as doing so will block most of the inadvertent writes (runc would run with reduced privileges, making attempts to write to procfs files ineffective).\n* Based on our analysis, neither AppArmor or SELinux can protect against the full version of the redirected write attack. The container runtime is generally privileged enough to write to arbitrary procfs files, which is more than sufficient to cause a container breakout.",
"product_ids": [
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:1fa845b0dfc4fd18b28558aae4e9fb69f220649495fb4e1284da0dc43f5cacac_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:5050558c5b76a544f8785a8ee6e153aaa1c4649e2ec897a1728d71c360ef9175_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:59335016a17f8557d8286926c3e738830683bf5bc8dea298ab0420e85b85d089_arm64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:a80ae4926abc8df9fb976f47911662aa5db8b4beed60efa37e94b1bc36a152c8_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:25a97ab36e361a6b9cb2a5621241d56b4b420d6a2e50a112fc209b09484abbbb_arm64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:2621107d4c7b72f2e6de593355711fa63ed8efc637d1ea17ea8ac1ffb796a139_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:55cf2e5dcae568fe3236363993f3987465b78f5f892c7fabcdec2bde63afb4fb_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b6778248c42c242c05accfbebbda445cb48d85484ea7011744f5b0bb32c56a40_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:62291ebc31aedc55cda270168146cf272856e1e566f75b0694f14e28adeed72c_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:9281889838e4c68f688024b27b4fb5e95b461ae63518533d08d06a5d3b499bed_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:e0d72f7dfeda202524e67c5b344af6a6ef64712cd4f04e90ac1e0dffc49addf7_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:ee47b302b5655b1a64d79ce370033956c14cfacd83b3f589f4eb153cc9201d62_arm64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:e2cbcab60fad0718e63a8c9bacaca97d205735e968505a56ae1a1c523d5ee2da_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:45059c429a74ea709c828dcdcf0eeb481ec0c27ec82fa4c7f6a46214749e6edb_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:b1cd378eba90e9258c1639305a8bd66120220333a3cdf2df5ebfb71d1e9d7539_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:f3c1bd5157e6791f150dbe211a5ca4a391e9e69ac07748a41bb0b829e645933a_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:ff3573bf04e5f74c9aa62f96c349cbe3599f7623a05acc1881eb321ee5d93487_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:1fa845b0dfc4fd18b28558aae4e9fb69f220649495fb4e1284da0dc43f5cacac_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:5050558c5b76a544f8785a8ee6e153aaa1c4649e2ec897a1728d71c360ef9175_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:59335016a17f8557d8286926c3e738830683bf5bc8dea298ab0420e85b85d089_arm64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:a80ae4926abc8df9fb976f47911662aa5db8b4beed60efa37e94b1bc36a152c8_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:25a97ab36e361a6b9cb2a5621241d56b4b420d6a2e50a112fc209b09484abbbb_arm64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:2621107d4c7b72f2e6de593355711fa63ed8efc637d1ea17ea8ac1ffb796a139_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:55cf2e5dcae568fe3236363993f3987465b78f5f892c7fabcdec2bde63afb4fb_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b6778248c42c242c05accfbebbda445cb48d85484ea7011744f5b0bb32c56a40_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:62291ebc31aedc55cda270168146cf272856e1e566f75b0694f14e28adeed72c_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:9281889838e4c68f688024b27b4fb5e95b461ae63518533d08d06a5d3b499bed_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:e0d72f7dfeda202524e67c5b344af6a6ef64712cd4f04e90ac1e0dffc49addf7_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:ee47b302b5655b1a64d79ce370033956c14cfacd83b3f589f4eb153cc9201d62_arm64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:e2cbcab60fad0718e63a8c9bacaca97d205735e968505a56ae1a1c523d5ee2da_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:45059c429a74ea709c828dcdcf0eeb481ec0c27ec82fa4c7f6a46214749e6edb_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:b1cd378eba90e9258c1639305a8bd66120220333a3cdf2df5ebfb71d1e9d7539_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:f3c1bd5157e6791f150dbe211a5ca4a391e9e69ac07748a41bb0b829e645933a_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:ff3573bf04e5f74c9aa62f96c349cbe3599f7623a05acc1881eb321ee5d93487_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "runc: opencontainers/selinux: container escape and denial of service due to arbitrary write gadgets and procfs write redirects"
},
{
"cve": "CVE-2025-61726",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-01-28T20:01:42.791305+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:1fa845b0dfc4fd18b28558aae4e9fb69f220649495fb4e1284da0dc43f5cacac_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:5050558c5b76a544f8785a8ee6e153aaa1c4649e2ec897a1728d71c360ef9175_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:59335016a17f8557d8286926c3e738830683bf5bc8dea298ab0420e85b85d089_arm64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:a80ae4926abc8df9fb976f47911662aa5db8b4beed60efa37e94b1bc36a152c8_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:25a97ab36e361a6b9cb2a5621241d56b4b420d6a2e50a112fc209b09484abbbb_arm64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:2621107d4c7b72f2e6de593355711fa63ed8efc637d1ea17ea8ac1ffb796a139_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:55cf2e5dcae568fe3236363993f3987465b78f5f892c7fabcdec2bde63afb4fb_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b6778248c42c242c05accfbebbda445cb48d85484ea7011744f5b0bb32c56a40_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:62291ebc31aedc55cda270168146cf272856e1e566f75b0694f14e28adeed72c_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:9281889838e4c68f688024b27b4fb5e95b461ae63518533d08d06a5d3b499bed_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:e0d72f7dfeda202524e67c5b344af6a6ef64712cd4f04e90ac1e0dffc49addf7_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:ee47b302b5655b1a64d79ce370033956c14cfacd83b3f589f4eb153cc9201d62_arm64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:45059c429a74ea709c828dcdcf0eeb481ec0c27ec82fa4c7f6a46214749e6edb_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:b1cd378eba90e9258c1639305a8bd66120220333a3cdf2df5ebfb71d1e9d7539_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:f3c1bd5157e6791f150dbe211a5ca4a391e9e69ac07748a41bb0b829e645933a_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:ff3573bf04e5f74c9aa62f96c349cbe3599f7623a05acc1881eb321ee5d93487_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2434432"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the net/url package in the Go standard library. The package does not enforce a limit on the number of unique query parameters it parses. A Go application using the net/http.Request.ParseForm method will try to process all parameters provided in the request. A specially crafted HTTP request containing a massive number of query parameters will cause the application to consume an excessive amount of memory, eventually causing the application to crash or become unresponsive, resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: net/url: Memory exhaustion in query parameter parsing in net/url",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker must be able to send a specially crafted HTTP request to an application parsing URL-encoded forms with net/url, specifically a request containing a large number of unique query parameters. The request will cause the application to consume an excessive amount of memory and eventually result in a denial of service, with no impact to confidentiality or integrity. Due to this reason, this vulnerability has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:e2cbcab60fad0718e63a8c9bacaca97d205735e968505a56ae1a1c523d5ee2da_amd64"
],
"known_not_affected": [
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:1fa845b0dfc4fd18b28558aae4e9fb69f220649495fb4e1284da0dc43f5cacac_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:5050558c5b76a544f8785a8ee6e153aaa1c4649e2ec897a1728d71c360ef9175_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:59335016a17f8557d8286926c3e738830683bf5bc8dea298ab0420e85b85d089_arm64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:a80ae4926abc8df9fb976f47911662aa5db8b4beed60efa37e94b1bc36a152c8_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:25a97ab36e361a6b9cb2a5621241d56b4b420d6a2e50a112fc209b09484abbbb_arm64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:2621107d4c7b72f2e6de593355711fa63ed8efc637d1ea17ea8ac1ffb796a139_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:55cf2e5dcae568fe3236363993f3987465b78f5f892c7fabcdec2bde63afb4fb_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b6778248c42c242c05accfbebbda445cb48d85484ea7011744f5b0bb32c56a40_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:62291ebc31aedc55cda270168146cf272856e1e566f75b0694f14e28adeed72c_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:9281889838e4c68f688024b27b4fb5e95b461ae63518533d08d06a5d3b499bed_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:e0d72f7dfeda202524e67c5b344af6a6ef64712cd4f04e90ac1e0dffc49addf7_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:ee47b302b5655b1a64d79ce370033956c14cfacd83b3f589f4eb153cc9201d62_arm64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:45059c429a74ea709c828dcdcf0eeb481ec0c27ec82fa4c7f6a46214749e6edb_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:b1cd378eba90e9258c1639305a8bd66120220333a3cdf2df5ebfb71d1e9d7539_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:f3c1bd5157e6791f150dbe211a5ca4a391e9e69ac07748a41bb0b829e645933a_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:ff3573bf04e5f74c9aa62f96c349cbe3599f7623a05acc1881eb321ee5d93487_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-61726"
},
{
"category": "external",
"summary": "RHBZ#2434432",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2434432"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-61726",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-61726"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-61726",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61726"
},
{
"category": "external",
"summary": "https://go.dev/cl/736712",
"url": "https://go.dev/cl/736712"
},
{
"category": "external",
"summary": "https://go.dev/issue/77101",
"url": "https://go.dev/issue/77101"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc",
"url": "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4341",
"url": "https://pkg.go.dev/vuln/GO-2026-4341"
}
],
"release_date": "2026-01-28T19:30:31.215000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T10:06:55+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your\nsystem have been applied. For details on how to apply this update, refer to:\n \nhttps://docs.openshift.com/container-platform/latest/updating/updating_a_cluster/updating-cluster-cli.html",
"product_ids": [
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:e2cbcab60fad0718e63a8c9bacaca97d205735e968505a56ae1a1c523d5ee2da_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8433"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:1fa845b0dfc4fd18b28558aae4e9fb69f220649495fb4e1284da0dc43f5cacac_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:5050558c5b76a544f8785a8ee6e153aaa1c4649e2ec897a1728d71c360ef9175_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:59335016a17f8557d8286926c3e738830683bf5bc8dea298ab0420e85b85d089_arm64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:a80ae4926abc8df9fb976f47911662aa5db8b4beed60efa37e94b1bc36a152c8_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:25a97ab36e361a6b9cb2a5621241d56b4b420d6a2e50a112fc209b09484abbbb_arm64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:2621107d4c7b72f2e6de593355711fa63ed8efc637d1ea17ea8ac1ffb796a139_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:55cf2e5dcae568fe3236363993f3987465b78f5f892c7fabcdec2bde63afb4fb_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b6778248c42c242c05accfbebbda445cb48d85484ea7011744f5b0bb32c56a40_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:62291ebc31aedc55cda270168146cf272856e1e566f75b0694f14e28adeed72c_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:9281889838e4c68f688024b27b4fb5e95b461ae63518533d08d06a5d3b499bed_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:e0d72f7dfeda202524e67c5b344af6a6ef64712cd4f04e90ac1e0dffc49addf7_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:ee47b302b5655b1a64d79ce370033956c14cfacd83b3f589f4eb153cc9201d62_arm64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:e2cbcab60fad0718e63a8c9bacaca97d205735e968505a56ae1a1c523d5ee2da_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:45059c429a74ea709c828dcdcf0eeb481ec0c27ec82fa4c7f6a46214749e6edb_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:b1cd378eba90e9258c1639305a8bd66120220333a3cdf2df5ebfb71d1e9d7539_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:f3c1bd5157e6791f150dbe211a5ca4a391e9e69ac07748a41bb0b829e645933a_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:ff3573bf04e5f74c9aa62f96c349cbe3599f7623a05acc1881eb321ee5d93487_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:1fa845b0dfc4fd18b28558aae4e9fb69f220649495fb4e1284da0dc43f5cacac_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:5050558c5b76a544f8785a8ee6e153aaa1c4649e2ec897a1728d71c360ef9175_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:59335016a17f8557d8286926c3e738830683bf5bc8dea298ab0420e85b85d089_arm64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:a80ae4926abc8df9fb976f47911662aa5db8b4beed60efa37e94b1bc36a152c8_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:25a97ab36e361a6b9cb2a5621241d56b4b420d6a2e50a112fc209b09484abbbb_arm64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:2621107d4c7b72f2e6de593355711fa63ed8efc637d1ea17ea8ac1ffb796a139_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:55cf2e5dcae568fe3236363993f3987465b78f5f892c7fabcdec2bde63afb4fb_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b6778248c42c242c05accfbebbda445cb48d85484ea7011744f5b0bb32c56a40_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:62291ebc31aedc55cda270168146cf272856e1e566f75b0694f14e28adeed72c_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:9281889838e4c68f688024b27b4fb5e95b461ae63518533d08d06a5d3b499bed_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:e0d72f7dfeda202524e67c5b344af6a6ef64712cd4f04e90ac1e0dffc49addf7_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:ee47b302b5655b1a64d79ce370033956c14cfacd83b3f589f4eb153cc9201d62_arm64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:e2cbcab60fad0718e63a8c9bacaca97d205735e968505a56ae1a1c523d5ee2da_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:45059c429a74ea709c828dcdcf0eeb481ec0c27ec82fa4c7f6a46214749e6edb_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:b1cd378eba90e9258c1639305a8bd66120220333a3cdf2df5ebfb71d1e9d7539_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:f3c1bd5157e6791f150dbe211a5ca4a391e9e69ac07748a41bb0b829e645933a_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:ff3573bf04e5f74c9aa62f96c349cbe3599f7623a05acc1881eb321ee5d93487_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang: net/url: Memory exhaustion in query parameter parsing in net/url"
},
{
"cve": "CVE-2025-61729",
"cwe": {
"id": "CWE-1050",
"name": "Excessive Platform Resource Consumption within a Loop"
},
"discovery_date": "2025-12-02T20:01:45.330964+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:1fa845b0dfc4fd18b28558aae4e9fb69f220649495fb4e1284da0dc43f5cacac_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:5050558c5b76a544f8785a8ee6e153aaa1c4649e2ec897a1728d71c360ef9175_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:59335016a17f8557d8286926c3e738830683bf5bc8dea298ab0420e85b85d089_arm64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:a80ae4926abc8df9fb976f47911662aa5db8b4beed60efa37e94b1bc36a152c8_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:25a97ab36e361a6b9cb2a5621241d56b4b420d6a2e50a112fc209b09484abbbb_arm64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:2621107d4c7b72f2e6de593355711fa63ed8efc637d1ea17ea8ac1ffb796a139_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:55cf2e5dcae568fe3236363993f3987465b78f5f892c7fabcdec2bde63afb4fb_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b6778248c42c242c05accfbebbda445cb48d85484ea7011744f5b0bb32c56a40_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:62291ebc31aedc55cda270168146cf272856e1e566f75b0694f14e28adeed72c_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:9281889838e4c68f688024b27b4fb5e95b461ae63518533d08d06a5d3b499bed_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:e0d72f7dfeda202524e67c5b344af6a6ef64712cd4f04e90ac1e0dffc49addf7_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:ee47b302b5655b1a64d79ce370033956c14cfacd83b3f589f4eb153cc9201d62_arm64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:45059c429a74ea709c828dcdcf0eeb481ec0c27ec82fa4c7f6a46214749e6edb_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:b1cd378eba90e9258c1639305a8bd66120220333a3cdf2df5ebfb71d1e9d7539_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:f3c1bd5157e6791f150dbe211a5ca4a391e9e69ac07748a41bb0b829e645933a_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:ff3573bf04e5f74c9aa62f96c349cbe3599f7623a05acc1881eb321ee5d93487_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2418462"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang. A remote attacker could exploit this vulnerability by providing a specially crafted certificate during the error string construction process within the `HostnameError.Error()` function. This flaw, caused by unbounded string concatenation, leads to excessive resource consumption. Successful exploitation can result in a denial of service (DoS) for the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:e2cbcab60fad0718e63a8c9bacaca97d205735e968505a56ae1a1c523d5ee2da_amd64"
],
"known_not_affected": [
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:1fa845b0dfc4fd18b28558aae4e9fb69f220649495fb4e1284da0dc43f5cacac_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:5050558c5b76a544f8785a8ee6e153aaa1c4649e2ec897a1728d71c360ef9175_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:59335016a17f8557d8286926c3e738830683bf5bc8dea298ab0420e85b85d089_arm64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:a80ae4926abc8df9fb976f47911662aa5db8b4beed60efa37e94b1bc36a152c8_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:25a97ab36e361a6b9cb2a5621241d56b4b420d6a2e50a112fc209b09484abbbb_arm64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:2621107d4c7b72f2e6de593355711fa63ed8efc637d1ea17ea8ac1ffb796a139_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:55cf2e5dcae568fe3236363993f3987465b78f5f892c7fabcdec2bde63afb4fb_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b6778248c42c242c05accfbebbda445cb48d85484ea7011744f5b0bb32c56a40_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:62291ebc31aedc55cda270168146cf272856e1e566f75b0694f14e28adeed72c_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:9281889838e4c68f688024b27b4fb5e95b461ae63518533d08d06a5d3b499bed_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:e0d72f7dfeda202524e67c5b344af6a6ef64712cd4f04e90ac1e0dffc49addf7_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:ee47b302b5655b1a64d79ce370033956c14cfacd83b3f589f4eb153cc9201d62_arm64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:45059c429a74ea709c828dcdcf0eeb481ec0c27ec82fa4c7f6a46214749e6edb_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:b1cd378eba90e9258c1639305a8bd66120220333a3cdf2df5ebfb71d1e9d7539_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:f3c1bd5157e6791f150dbe211a5ca4a391e9e69ac07748a41bb0b829e645933a_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:ff3573bf04e5f74c9aa62f96c349cbe3599f7623a05acc1881eb321ee5d93487_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-61729"
},
{
"category": "external",
"summary": "RHBZ#2418462",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418462"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-61729",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-61729"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-61729",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61729"
},
{
"category": "external",
"summary": "https://go.dev/cl/725920",
"url": "https://go.dev/cl/725920"
},
{
"category": "external",
"summary": "https://go.dev/issue/76445",
"url": "https://go.dev/issue/76445"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/8FJoBkPddm4",
"url": "https://groups.google.com/g/golang-announce/c/8FJoBkPddm4"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2025-4155",
"url": "https://pkg.go.dev/vuln/GO-2025-4155"
}
],
"release_date": "2025-12-02T18:54:10.166000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T10:06:55+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your\nsystem have been applied. For details on how to apply this update, refer to:\n \nhttps://docs.openshift.com/container-platform/latest/updating/updating_a_cluster/updating-cluster-cli.html",
"product_ids": [
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:e2cbcab60fad0718e63a8c9bacaca97d205735e968505a56ae1a1c523d5ee2da_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8433"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:1fa845b0dfc4fd18b28558aae4e9fb69f220649495fb4e1284da0dc43f5cacac_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:5050558c5b76a544f8785a8ee6e153aaa1c4649e2ec897a1728d71c360ef9175_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:59335016a17f8557d8286926c3e738830683bf5bc8dea298ab0420e85b85d089_arm64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:a80ae4926abc8df9fb976f47911662aa5db8b4beed60efa37e94b1bc36a152c8_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:25a97ab36e361a6b9cb2a5621241d56b4b420d6a2e50a112fc209b09484abbbb_arm64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:2621107d4c7b72f2e6de593355711fa63ed8efc637d1ea17ea8ac1ffb796a139_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:55cf2e5dcae568fe3236363993f3987465b78f5f892c7fabcdec2bde63afb4fb_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b6778248c42c242c05accfbebbda445cb48d85484ea7011744f5b0bb32c56a40_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:62291ebc31aedc55cda270168146cf272856e1e566f75b0694f14e28adeed72c_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:9281889838e4c68f688024b27b4fb5e95b461ae63518533d08d06a5d3b499bed_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:e0d72f7dfeda202524e67c5b344af6a6ef64712cd4f04e90ac1e0dffc49addf7_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:ee47b302b5655b1a64d79ce370033956c14cfacd83b3f589f4eb153cc9201d62_arm64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:e2cbcab60fad0718e63a8c9bacaca97d205735e968505a56ae1a1c523d5ee2da_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:45059c429a74ea709c828dcdcf0eeb481ec0c27ec82fa4c7f6a46214749e6edb_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:b1cd378eba90e9258c1639305a8bd66120220333a3cdf2df5ebfb71d1e9d7539_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:f3c1bd5157e6791f150dbe211a5ca4a391e9e69ac07748a41bb0b829e645933a_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:ff3573bf04e5f74c9aa62f96c349cbe3599f7623a05acc1881eb321ee5d93487_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate"
},
{
"cve": "CVE-2025-68121",
"discovery_date": "2026-02-05T18:01:30.086058+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:1fa845b0dfc4fd18b28558aae4e9fb69f220649495fb4e1284da0dc43f5cacac_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:5050558c5b76a544f8785a8ee6e153aaa1c4649e2ec897a1728d71c360ef9175_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:59335016a17f8557d8286926c3e738830683bf5bc8dea298ab0420e85b85d089_arm64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:a80ae4926abc8df9fb976f47911662aa5db8b4beed60efa37e94b1bc36a152c8_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:25a97ab36e361a6b9cb2a5621241d56b4b420d6a2e50a112fc209b09484abbbb_arm64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:2621107d4c7b72f2e6de593355711fa63ed8efc637d1ea17ea8ac1ffb796a139_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:55cf2e5dcae568fe3236363993f3987465b78f5f892c7fabcdec2bde63afb4fb_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b6778248c42c242c05accfbebbda445cb48d85484ea7011744f5b0bb32c56a40_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:62291ebc31aedc55cda270168146cf272856e1e566f75b0694f14e28adeed72c_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:9281889838e4c68f688024b27b4fb5e95b461ae63518533d08d06a5d3b499bed_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:e0d72f7dfeda202524e67c5b344af6a6ef64712cd4f04e90ac1e0dffc49addf7_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:ee47b302b5655b1a64d79ce370033956c14cfacd83b3f589f4eb153cc9201d62_arm64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:45059c429a74ea709c828dcdcf0eeb481ec0c27ec82fa4c7f6a46214749e6edb_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:b1cd378eba90e9258c1639305a8bd66120220333a3cdf2df5ebfb71d1e9d7539_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:f3c1bd5157e6791f150dbe211a5ca4a391e9e69ac07748a41bb0b829e645933a_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:ff3573bf04e5f74c9aa62f96c349cbe3599f7623a05acc1881eb321ee5d93487_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2437111"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the crypto/tls component. This vulnerability occurs during Transport Layer Security (TLS) session resumption when certificate authority (CA) settings are modified between the initial and resumed handshakes. An attacker could exploit this to bypass certificate validation, allowing a client or server to establish a connection that should have been rejected. This could lead to an authentication bypass under specific conditions.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is a moderate flaw because it only occurs under specific conditions, such as TLS session resumption with runtime changes to certificate authority settings. Exploitation is not straightforward and requires a controlled setup. The impact is limited to certificate validation within the same component and does not affect system availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:e2cbcab60fad0718e63a8c9bacaca97d205735e968505a56ae1a1c523d5ee2da_amd64"
],
"known_not_affected": [
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:1fa845b0dfc4fd18b28558aae4e9fb69f220649495fb4e1284da0dc43f5cacac_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:5050558c5b76a544f8785a8ee6e153aaa1c4649e2ec897a1728d71c360ef9175_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:59335016a17f8557d8286926c3e738830683bf5bc8dea298ab0420e85b85d089_arm64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:a80ae4926abc8df9fb976f47911662aa5db8b4beed60efa37e94b1bc36a152c8_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:25a97ab36e361a6b9cb2a5621241d56b4b420d6a2e50a112fc209b09484abbbb_arm64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:2621107d4c7b72f2e6de593355711fa63ed8efc637d1ea17ea8ac1ffb796a139_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:55cf2e5dcae568fe3236363993f3987465b78f5f892c7fabcdec2bde63afb4fb_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b6778248c42c242c05accfbebbda445cb48d85484ea7011744f5b0bb32c56a40_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:62291ebc31aedc55cda270168146cf272856e1e566f75b0694f14e28adeed72c_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:9281889838e4c68f688024b27b4fb5e95b461ae63518533d08d06a5d3b499bed_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:e0d72f7dfeda202524e67c5b344af6a6ef64712cd4f04e90ac1e0dffc49addf7_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:ee47b302b5655b1a64d79ce370033956c14cfacd83b3f589f4eb153cc9201d62_arm64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:45059c429a74ea709c828dcdcf0eeb481ec0c27ec82fa4c7f6a46214749e6edb_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:b1cd378eba90e9258c1639305a8bd66120220333a3cdf2df5ebfb71d1e9d7539_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:f3c1bd5157e6791f150dbe211a5ca4a391e9e69ac07748a41bb0b829e645933a_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:ff3573bf04e5f74c9aa62f96c349cbe3599f7623a05acc1881eb321ee5d93487_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-68121"
},
{
"category": "external",
"summary": "RHBZ#2437111",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2437111"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-68121",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-68121"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-68121",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68121"
},
{
"category": "external",
"summary": "https://go.dev/cl/737700",
"url": "https://go.dev/cl/737700"
},
{
"category": "external",
"summary": "https://go.dev/issue/77217",
"url": "https://go.dev/issue/77217"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/K09ubi9FQFk",
"url": "https://groups.google.com/g/golang-announce/c/K09ubi9FQFk"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4337",
"url": "https://pkg.go.dev/vuln/GO-2026-4337"
}
],
"release_date": "2026-02-05T17:48:44.141000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T10:06:55+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your\nsystem have been applied. For details on how to apply this update, refer to:\n \nhttps://docs.openshift.com/container-platform/latest/updating/updating_a_cluster/updating-cluster-cli.html",
"product_ids": [
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:e2cbcab60fad0718e63a8c9bacaca97d205735e968505a56ae1a1c523d5ee2da_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8433"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:1fa845b0dfc4fd18b28558aae4e9fb69f220649495fb4e1284da0dc43f5cacac_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:5050558c5b76a544f8785a8ee6e153aaa1c4649e2ec897a1728d71c360ef9175_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:59335016a17f8557d8286926c3e738830683bf5bc8dea298ab0420e85b85d089_arm64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:a80ae4926abc8df9fb976f47911662aa5db8b4beed60efa37e94b1bc36a152c8_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:25a97ab36e361a6b9cb2a5621241d56b4b420d6a2e50a112fc209b09484abbbb_arm64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:2621107d4c7b72f2e6de593355711fa63ed8efc637d1ea17ea8ac1ffb796a139_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:55cf2e5dcae568fe3236363993f3987465b78f5f892c7fabcdec2bde63afb4fb_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b6778248c42c242c05accfbebbda445cb48d85484ea7011744f5b0bb32c56a40_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:62291ebc31aedc55cda270168146cf272856e1e566f75b0694f14e28adeed72c_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:9281889838e4c68f688024b27b4fb5e95b461ae63518533d08d06a5d3b499bed_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:e0d72f7dfeda202524e67c5b344af6a6ef64712cd4f04e90ac1e0dffc49addf7_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:ee47b302b5655b1a64d79ce370033956c14cfacd83b3f589f4eb153cc9201d62_arm64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:e2cbcab60fad0718e63a8c9bacaca97d205735e968505a56ae1a1c523d5ee2da_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:45059c429a74ea709c828dcdcf0eeb481ec0c27ec82fa4c7f6a46214749e6edb_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:b1cd378eba90e9258c1639305a8bd66120220333a3cdf2df5ebfb71d1e9d7539_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:f3c1bd5157e6791f150dbe211a5ca4a391e9e69ac07748a41bb0b829e645933a_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:ff3573bf04e5f74c9aa62f96c349cbe3599f7623a05acc1881eb321ee5d93487_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption"
},
{
"cve": "CVE-2026-4645",
"discovery_date": "2026-03-23T06:02:52.120840+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:1fa845b0dfc4fd18b28558aae4e9fb69f220649495fb4e1284da0dc43f5cacac_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:5050558c5b76a544f8785a8ee6e153aaa1c4649e2ec897a1728d71c360ef9175_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:59335016a17f8557d8286926c3e738830683bf5bc8dea298ab0420e85b85d089_arm64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:a80ae4926abc8df9fb976f47911662aa5db8b4beed60efa37e94b1bc36a152c8_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:25a97ab36e361a6b9cb2a5621241d56b4b420d6a2e50a112fc209b09484abbbb_arm64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:2621107d4c7b72f2e6de593355711fa63ed8efc637d1ea17ea8ac1ffb796a139_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:55cf2e5dcae568fe3236363993f3987465b78f5f892c7fabcdec2bde63afb4fb_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b6778248c42c242c05accfbebbda445cb48d85484ea7011744f5b0bb32c56a40_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:62291ebc31aedc55cda270168146cf272856e1e566f75b0694f14e28adeed72c_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:9281889838e4c68f688024b27b4fb5e95b461ae63518533d08d06a5d3b499bed_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:e0d72f7dfeda202524e67c5b344af6a6ef64712cd4f04e90ac1e0dffc49addf7_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:ee47b302b5655b1a64d79ce370033956c14cfacd83b3f589f4eb153cc9201d62_arm64"
]
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `github.com/antchfx/xpath` component. A remote attacker could exploit this vulnerability by submitting crafted Boolean XPath expressions that evaluate to true. This can cause an infinite loop in the `logicalQuery.Select` function, leading to 100% CPU utilization and a Denial of Service (DoS) condition for the affected system.",
"title": "Vulnerability description"
},
{
"category": "other",
"text": "A denial of service vulnerability was discovered in `github.com/antchfx/xpath`, with Important severity. Systems processing untrusted XPath expressions are vulnerable to an infinite loop, leading to 100% CPU utilization which would impact normal operations of the system.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:e2cbcab60fad0718e63a8c9bacaca97d205735e968505a56ae1a1c523d5ee2da_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:45059c429a74ea709c828dcdcf0eeb481ec0c27ec82fa4c7f6a46214749e6edb_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:b1cd378eba90e9258c1639305a8bd66120220333a3cdf2df5ebfb71d1e9d7539_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:f3c1bd5157e6791f150dbe211a5ca4a391e9e69ac07748a41bb0b829e645933a_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:ff3573bf04e5f74c9aa62f96c349cbe3599f7623a05acc1881eb321ee5d93487_arm64"
],
"known_not_affected": [
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:1fa845b0dfc4fd18b28558aae4e9fb69f220649495fb4e1284da0dc43f5cacac_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:5050558c5b76a544f8785a8ee6e153aaa1c4649e2ec897a1728d71c360ef9175_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:59335016a17f8557d8286926c3e738830683bf5bc8dea298ab0420e85b85d089_arm64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:a80ae4926abc8df9fb976f47911662aa5db8b4beed60efa37e94b1bc36a152c8_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:25a97ab36e361a6b9cb2a5621241d56b4b420d6a2e50a112fc209b09484abbbb_arm64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:2621107d4c7b72f2e6de593355711fa63ed8efc637d1ea17ea8ac1ffb796a139_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:55cf2e5dcae568fe3236363993f3987465b78f5f892c7fabcdec2bde63afb4fb_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b6778248c42c242c05accfbebbda445cb48d85484ea7011744f5b0bb32c56a40_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:62291ebc31aedc55cda270168146cf272856e1e566f75b0694f14e28adeed72c_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:9281889838e4c68f688024b27b4fb5e95b461ae63518533d08d06a5d3b499bed_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:e0d72f7dfeda202524e67c5b344af6a6ef64712cd4f04e90ac1e0dffc49addf7_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:ee47b302b5655b1a64d79ce370033956c14cfacd83b3f589f4eb153cc9201d62_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4645"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4645",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4645"
}
],
"release_date": "2026-03-17T20:58:59+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T10:06:55+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your\nsystem have been applied. For details on how to apply this update, refer to:\n \nhttps://docs.openshift.com/container-platform/latest/updating/updating_a_cluster/updating-cluster-cli.html",
"product_ids": [
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:e2cbcab60fad0718e63a8c9bacaca97d205735e968505a56ae1a1c523d5ee2da_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:45059c429a74ea709c828dcdcf0eeb481ec0c27ec82fa4c7f6a46214749e6edb_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:b1cd378eba90e9258c1639305a8bd66120220333a3cdf2df5ebfb71d1e9d7539_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:f3c1bd5157e6791f150dbe211a5ca4a391e9e69ac07748a41bb0b829e645933a_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:ff3573bf04e5f74c9aa62f96c349cbe3599f7623a05acc1881eb321ee5d93487_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8433"
},
{
"category": "workaround",
"details": "To mitigate this issue, restrict the processing of untrusted or unvalidated XPath expressions by applications which utilize the `github.com/antchfx/xpath` component. Implement input validation and sanitization for all XPath expressions originating from external or untrusted sources. If possible, configure applications to only process XPath expressions from trusted sources or disable features that allow arbitrary XPath expression evaluation.",
"product_ids": [
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:1fa845b0dfc4fd18b28558aae4e9fb69f220649495fb4e1284da0dc43f5cacac_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:5050558c5b76a544f8785a8ee6e153aaa1c4649e2ec897a1728d71c360ef9175_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:59335016a17f8557d8286926c3e738830683bf5bc8dea298ab0420e85b85d089_arm64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:a80ae4926abc8df9fb976f47911662aa5db8b4beed60efa37e94b1bc36a152c8_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:25a97ab36e361a6b9cb2a5621241d56b4b420d6a2e50a112fc209b09484abbbb_arm64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:2621107d4c7b72f2e6de593355711fa63ed8efc637d1ea17ea8ac1ffb796a139_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:55cf2e5dcae568fe3236363993f3987465b78f5f892c7fabcdec2bde63afb4fb_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b6778248c42c242c05accfbebbda445cb48d85484ea7011744f5b0bb32c56a40_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:62291ebc31aedc55cda270168146cf272856e1e566f75b0694f14e28adeed72c_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:9281889838e4c68f688024b27b4fb5e95b461ae63518533d08d06a5d3b499bed_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:e0d72f7dfeda202524e67c5b344af6a6ef64712cd4f04e90ac1e0dffc49addf7_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:ee47b302b5655b1a64d79ce370033956c14cfacd83b3f589f4eb153cc9201d62_arm64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:e2cbcab60fad0718e63a8c9bacaca97d205735e968505a56ae1a1c523d5ee2da_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:45059c429a74ea709c828dcdcf0eeb481ec0c27ec82fa4c7f6a46214749e6edb_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:b1cd378eba90e9258c1639305a8bd66120220333a3cdf2df5ebfb71d1e9d7539_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:f3c1bd5157e6791f150dbe211a5ca4a391e9e69ac07748a41bb0b829e645933a_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:ff3573bf04e5f74c9aa62f96c349cbe3599f7623a05acc1881eb321ee5d93487_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:1fa845b0dfc4fd18b28558aae4e9fb69f220649495fb4e1284da0dc43f5cacac_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:5050558c5b76a544f8785a8ee6e153aaa1c4649e2ec897a1728d71c360ef9175_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:59335016a17f8557d8286926c3e738830683bf5bc8dea298ab0420e85b85d089_arm64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:a80ae4926abc8df9fb976f47911662aa5db8b4beed60efa37e94b1bc36a152c8_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:25a97ab36e361a6b9cb2a5621241d56b4b420d6a2e50a112fc209b09484abbbb_arm64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:2621107d4c7b72f2e6de593355711fa63ed8efc637d1ea17ea8ac1ffb796a139_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:55cf2e5dcae568fe3236363993f3987465b78f5f892c7fabcdec2bde63afb4fb_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b6778248c42c242c05accfbebbda445cb48d85484ea7011744f5b0bb32c56a40_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:62291ebc31aedc55cda270168146cf272856e1e566f75b0694f14e28adeed72c_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:9281889838e4c68f688024b27b4fb5e95b461ae63518533d08d06a5d3b499bed_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:e0d72f7dfeda202524e67c5b344af6a6ef64712cd4f04e90ac1e0dffc49addf7_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:ee47b302b5655b1a64d79ce370033956c14cfacd83b3f589f4eb153cc9201d62_arm64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:e2cbcab60fad0718e63a8c9bacaca97d205735e968505a56ae1a1c523d5ee2da_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:45059c429a74ea709c828dcdcf0eeb481ec0c27ec82fa4c7f6a46214749e6edb_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:b1cd378eba90e9258c1639305a8bd66120220333a3cdf2df5ebfb71d1e9d7539_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:f3c1bd5157e6791f150dbe211a5ca4a391e9e69ac07748a41bb0b829e645933a_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:ff3573bf04e5f74c9aa62f96c349cbe3599f7623a05acc1881eb321ee5d93487_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/antchfx/xpath: xpath: Denial of Service via crafted Boolean XPath expressions"
},
{
"cve": "CVE-2026-25679",
"cwe": {
"id": "CWE-1286",
"name": "Improper Validation of Syntactic Correctness of Input"
},
"discovery_date": "2026-03-06T22:02:11.567841+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:1fa845b0dfc4fd18b28558aae4e9fb69f220649495fb4e1284da0dc43f5cacac_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:5050558c5b76a544f8785a8ee6e153aaa1c4649e2ec897a1728d71c360ef9175_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:59335016a17f8557d8286926c3e738830683bf5bc8dea298ab0420e85b85d089_arm64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:a80ae4926abc8df9fb976f47911662aa5db8b4beed60efa37e94b1bc36a152c8_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:25a97ab36e361a6b9cb2a5621241d56b4b420d6a2e50a112fc209b09484abbbb_arm64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:2621107d4c7b72f2e6de593355711fa63ed8efc637d1ea17ea8ac1ffb796a139_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:55cf2e5dcae568fe3236363993f3987465b78f5f892c7fabcdec2bde63afb4fb_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b6778248c42c242c05accfbebbda445cb48d85484ea7011744f5b0bb32c56a40_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:62291ebc31aedc55cda270168146cf272856e1e566f75b0694f14e28adeed72c_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:9281889838e4c68f688024b27b4fb5e95b461ae63518533d08d06a5d3b499bed_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:e0d72f7dfeda202524e67c5b344af6a6ef64712cd4f04e90ac1e0dffc49addf7_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:ee47b302b5655b1a64d79ce370033956c14cfacd83b3f589f4eb153cc9201d62_arm64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:45059c429a74ea709c828dcdcf0eeb481ec0c27ec82fa4c7f6a46214749e6edb_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:b1cd378eba90e9258c1639305a8bd66120220333a3cdf2df5ebfb71d1e9d7539_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:f3c1bd5157e6791f150dbe211a5ca4a391e9e69ac07748a41bb0b829e645933a_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:ff3573bf04e5f74c9aa62f96c349cbe3599f7623a05acc1881eb321ee5d93487_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445356"
}
],
"notes": [
{
"category": "description",
"text": "The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/url: Incorrect parsing of IPv6 host literals in net/url",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:e2cbcab60fad0718e63a8c9bacaca97d205735e968505a56ae1a1c523d5ee2da_amd64"
],
"known_not_affected": [
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:1fa845b0dfc4fd18b28558aae4e9fb69f220649495fb4e1284da0dc43f5cacac_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:5050558c5b76a544f8785a8ee6e153aaa1c4649e2ec897a1728d71c360ef9175_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:59335016a17f8557d8286926c3e738830683bf5bc8dea298ab0420e85b85d089_arm64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:a80ae4926abc8df9fb976f47911662aa5db8b4beed60efa37e94b1bc36a152c8_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:25a97ab36e361a6b9cb2a5621241d56b4b420d6a2e50a112fc209b09484abbbb_arm64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:2621107d4c7b72f2e6de593355711fa63ed8efc637d1ea17ea8ac1ffb796a139_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:55cf2e5dcae568fe3236363993f3987465b78f5f892c7fabcdec2bde63afb4fb_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b6778248c42c242c05accfbebbda445cb48d85484ea7011744f5b0bb32c56a40_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:62291ebc31aedc55cda270168146cf272856e1e566f75b0694f14e28adeed72c_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:9281889838e4c68f688024b27b4fb5e95b461ae63518533d08d06a5d3b499bed_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:e0d72f7dfeda202524e67c5b344af6a6ef64712cd4f04e90ac1e0dffc49addf7_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:ee47b302b5655b1a64d79ce370033956c14cfacd83b3f589f4eb153cc9201d62_arm64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:45059c429a74ea709c828dcdcf0eeb481ec0c27ec82fa4c7f6a46214749e6edb_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:b1cd378eba90e9258c1639305a8bd66120220333a3cdf2df5ebfb71d1e9d7539_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:f3c1bd5157e6791f150dbe211a5ca4a391e9e69ac07748a41bb0b829e645933a_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:ff3573bf04e5f74c9aa62f96c349cbe3599f7623a05acc1881eb321ee5d93487_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-25679"
},
{
"category": "external",
"summary": "RHBZ#2445356",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445356"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-25679",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25679"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679"
},
{
"category": "external",
"summary": "https://go.dev/cl/752180",
"url": "https://go.dev/cl/752180"
},
{
"category": "external",
"summary": "https://go.dev/issue/77578",
"url": "https://go.dev/issue/77578"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk",
"url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4601",
"url": "https://pkg.go.dev/vuln/GO-2026-4601"
}
],
"release_date": "2026-03-06T21:28:14.211000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T10:06:55+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your\nsystem have been applied. For details on how to apply this update, refer to:\n \nhttps://docs.openshift.com/container-platform/latest/updating/updating_a_cluster/updating-cluster-cli.html",
"product_ids": [
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:e2cbcab60fad0718e63a8c9bacaca97d205735e968505a56ae1a1c523d5ee2da_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8433"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:1fa845b0dfc4fd18b28558aae4e9fb69f220649495fb4e1284da0dc43f5cacac_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:5050558c5b76a544f8785a8ee6e153aaa1c4649e2ec897a1728d71c360ef9175_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:59335016a17f8557d8286926c3e738830683bf5bc8dea298ab0420e85b85d089_arm64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:a80ae4926abc8df9fb976f47911662aa5db8b4beed60efa37e94b1bc36a152c8_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:25a97ab36e361a6b9cb2a5621241d56b4b420d6a2e50a112fc209b09484abbbb_arm64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:2621107d4c7b72f2e6de593355711fa63ed8efc637d1ea17ea8ac1ffb796a139_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:55cf2e5dcae568fe3236363993f3987465b78f5f892c7fabcdec2bde63afb4fb_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b6778248c42c242c05accfbebbda445cb48d85484ea7011744f5b0bb32c56a40_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:62291ebc31aedc55cda270168146cf272856e1e566f75b0694f14e28adeed72c_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:9281889838e4c68f688024b27b4fb5e95b461ae63518533d08d06a5d3b499bed_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:e0d72f7dfeda202524e67c5b344af6a6ef64712cd4f04e90ac1e0dffc49addf7_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:ee47b302b5655b1a64d79ce370033956c14cfacd83b3f589f4eb153cc9201d62_arm64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:e2cbcab60fad0718e63a8c9bacaca97d205735e968505a56ae1a1c523d5ee2da_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:45059c429a74ea709c828dcdcf0eeb481ec0c27ec82fa4c7f6a46214749e6edb_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:b1cd378eba90e9258c1639305a8bd66120220333a3cdf2df5ebfb71d1e9d7539_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:f3c1bd5157e6791f150dbe211a5ca4a391e9e69ac07748a41bb0b829e645933a_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:ff3573bf04e5f74c9aa62f96c349cbe3599f7623a05acc1881eb321ee5d93487_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:1fa845b0dfc4fd18b28558aae4e9fb69f220649495fb4e1284da0dc43f5cacac_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:5050558c5b76a544f8785a8ee6e153aaa1c4649e2ec897a1728d71c360ef9175_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:59335016a17f8557d8286926c3e738830683bf5bc8dea298ab0420e85b85d089_arm64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:a80ae4926abc8df9fb976f47911662aa5db8b4beed60efa37e94b1bc36a152c8_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:25a97ab36e361a6b9cb2a5621241d56b4b420d6a2e50a112fc209b09484abbbb_arm64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:2621107d4c7b72f2e6de593355711fa63ed8efc637d1ea17ea8ac1ffb796a139_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:55cf2e5dcae568fe3236363993f3987465b78f5f892c7fabcdec2bde63afb4fb_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b6778248c42c242c05accfbebbda445cb48d85484ea7011744f5b0bb32c56a40_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:62291ebc31aedc55cda270168146cf272856e1e566f75b0694f14e28adeed72c_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:9281889838e4c68f688024b27b4fb5e95b461ae63518533d08d06a5d3b499bed_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:e0d72f7dfeda202524e67c5b344af6a6ef64712cd4f04e90ac1e0dffc49addf7_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:ee47b302b5655b1a64d79ce370033956c14cfacd83b3f589f4eb153cc9201d62_arm64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:e2cbcab60fad0718e63a8c9bacaca97d205735e968505a56ae1a1c523d5ee2da_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:45059c429a74ea709c828dcdcf0eeb481ec0c27ec82fa4c7f6a46214749e6edb_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:b1cd378eba90e9258c1639305a8bd66120220333a3cdf2df5ebfb71d1e9d7539_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:f3c1bd5157e6791f150dbe211a5ca4a391e9e69ac07748a41bb0b829e645933a_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:ff3573bf04e5f74c9aa62f96c349cbe3599f7623a05acc1881eb321ee5d93487_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net/url: Incorrect parsing of IPv6 host literals in net/url"
},
{
"cve": "CVE-2026-33186",
"cwe": {
"id": "CWE-551",
"name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
},
"discovery_date": "2026-03-20T23:02:27.802640+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:1fa845b0dfc4fd18b28558aae4e9fb69f220649495fb4e1284da0dc43f5cacac_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:5050558c5b76a544f8785a8ee6e153aaa1c4649e2ec897a1728d71c360ef9175_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:59335016a17f8557d8286926c3e738830683bf5bc8dea298ab0420e85b85d089_arm64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:a80ae4926abc8df9fb976f47911662aa5db8b4beed60efa37e94b1bc36a152c8_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:25a97ab36e361a6b9cb2a5621241d56b4b420d6a2e50a112fc209b09484abbbb_arm64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:2621107d4c7b72f2e6de593355711fa63ed8efc637d1ea17ea8ac1ffb796a139_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:55cf2e5dcae568fe3236363993f3987465b78f5f892c7fabcdec2bde63afb4fb_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b6778248c42c242c05accfbebbda445cb48d85484ea7011744f5b0bb32c56a40_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:62291ebc31aedc55cda270168146cf272856e1e566f75b0694f14e28adeed72c_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:9281889838e4c68f688024b27b4fb5e95b461ae63518533d08d06a5d3b499bed_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:e0d72f7dfeda202524e67c5b344af6a6ef64712cd4f04e90ac1e0dffc49addf7_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:ee47b302b5655b1a64d79ce370033956c14cfacd83b3f589f4eb153cc9201d62_arm64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:45059c429a74ea709c828dcdcf0eeb481ec0c27ec82fa4c7f6a46214749e6edb_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:b1cd378eba90e9258c1639305a8bd66120220333a3cdf2df5ebfb71d1e9d7539_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:f3c1bd5157e6791f150dbe211a5ca4a391e9e69ac07748a41bb0b829e645933a_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:ff3573bf04e5f74c9aa62f96c349cbe3599f7623a05acc1881eb321ee5d93487_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2449833"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:e2cbcab60fad0718e63a8c9bacaca97d205735e968505a56ae1a1c523d5ee2da_amd64"
],
"known_not_affected": [
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:1fa845b0dfc4fd18b28558aae4e9fb69f220649495fb4e1284da0dc43f5cacac_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:5050558c5b76a544f8785a8ee6e153aaa1c4649e2ec897a1728d71c360ef9175_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:59335016a17f8557d8286926c3e738830683bf5bc8dea298ab0420e85b85d089_arm64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:a80ae4926abc8df9fb976f47911662aa5db8b4beed60efa37e94b1bc36a152c8_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:25a97ab36e361a6b9cb2a5621241d56b4b420d6a2e50a112fc209b09484abbbb_arm64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:2621107d4c7b72f2e6de593355711fa63ed8efc637d1ea17ea8ac1ffb796a139_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:55cf2e5dcae568fe3236363993f3987465b78f5f892c7fabcdec2bde63afb4fb_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b6778248c42c242c05accfbebbda445cb48d85484ea7011744f5b0bb32c56a40_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:62291ebc31aedc55cda270168146cf272856e1e566f75b0694f14e28adeed72c_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:9281889838e4c68f688024b27b4fb5e95b461ae63518533d08d06a5d3b499bed_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:e0d72f7dfeda202524e67c5b344af6a6ef64712cd4f04e90ac1e0dffc49addf7_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:ee47b302b5655b1a64d79ce370033956c14cfacd83b3f589f4eb153cc9201d62_arm64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:45059c429a74ea709c828dcdcf0eeb481ec0c27ec82fa4c7f6a46214749e6edb_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:b1cd378eba90e9258c1639305a8bd66120220333a3cdf2df5ebfb71d1e9d7539_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:f3c1bd5157e6791f150dbe211a5ca4a391e9e69ac07748a41bb0b829e645933a_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:ff3573bf04e5f74c9aa62f96c349cbe3599f7623a05acc1881eb321ee5d93487_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33186"
},
{
"category": "external",
"summary": "RHBZ#2449833",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449833"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33186",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33186"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186"
},
{
"category": "external",
"summary": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3",
"url": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3"
}
],
"release_date": "2026-03-20T22:23:32.147000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-04-16T10:06:55+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your\nsystem have been applied. For details on how to apply this update, refer to:\n \nhttps://docs.openshift.com/container-platform/latest/updating/updating_a_cluster/updating-cluster-cli.html",
"product_ids": [
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:e2cbcab60fad0718e63a8c9bacaca97d205735e968505a56ae1a1c523d5ee2da_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:8433"
},
{
"category": "workaround",
"details": "To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.",
"product_ids": [
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:1fa845b0dfc4fd18b28558aae4e9fb69f220649495fb4e1284da0dc43f5cacac_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:5050558c5b76a544f8785a8ee6e153aaa1c4649e2ec897a1728d71c360ef9175_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:59335016a17f8557d8286926c3e738830683bf5bc8dea298ab0420e85b85d089_arm64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:a80ae4926abc8df9fb976f47911662aa5db8b4beed60efa37e94b1bc36a152c8_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:25a97ab36e361a6b9cb2a5621241d56b4b420d6a2e50a112fc209b09484abbbb_arm64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:2621107d4c7b72f2e6de593355711fa63ed8efc637d1ea17ea8ac1ffb796a139_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:55cf2e5dcae568fe3236363993f3987465b78f5f892c7fabcdec2bde63afb4fb_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b6778248c42c242c05accfbebbda445cb48d85484ea7011744f5b0bb32c56a40_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:62291ebc31aedc55cda270168146cf272856e1e566f75b0694f14e28adeed72c_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:9281889838e4c68f688024b27b4fb5e95b461ae63518533d08d06a5d3b499bed_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:e0d72f7dfeda202524e67c5b344af6a6ef64712cd4f04e90ac1e0dffc49addf7_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:ee47b302b5655b1a64d79ce370033956c14cfacd83b3f589f4eb153cc9201d62_arm64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:e2cbcab60fad0718e63a8c9bacaca97d205735e968505a56ae1a1c523d5ee2da_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:45059c429a74ea709c828dcdcf0eeb481ec0c27ec82fa4c7f6a46214749e6edb_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:b1cd378eba90e9258c1639305a8bd66120220333a3cdf2df5ebfb71d1e9d7539_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:f3c1bd5157e6791f150dbe211a5ca4a391e9e69ac07748a41bb0b829e645933a_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:ff3573bf04e5f74c9aa62f96c349cbe3599f7623a05acc1881eb321ee5d93487_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:1fa845b0dfc4fd18b28558aae4e9fb69f220649495fb4e1284da0dc43f5cacac_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:5050558c5b76a544f8785a8ee6e153aaa1c4649e2ec897a1728d71c360ef9175_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:59335016a17f8557d8286926c3e738830683bf5bc8dea298ab0420e85b85d089_arm64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:a80ae4926abc8df9fb976f47911662aa5db8b4beed60efa37e94b1bc36a152c8_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:25a97ab36e361a6b9cb2a5621241d56b4b420d6a2e50a112fc209b09484abbbb_arm64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:2621107d4c7b72f2e6de593355711fa63ed8efc637d1ea17ea8ac1ffb796a139_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:55cf2e5dcae568fe3236363993f3987465b78f5f892c7fabcdec2bde63afb4fb_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-must-gather-rhel8@sha256:b6778248c42c242c05accfbebbda445cb48d85484ea7011744f5b0bb32c56a40_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:62291ebc31aedc55cda270168146cf272856e1e566f75b0694f14e28adeed72c_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:9281889838e4c68f688024b27b4fb5e95b461ae63518533d08d06a5d3b499bed_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:e0d72f7dfeda202524e67c5b344af6a6ef64712cd4f04e90ac1e0dffc49addf7_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-openscap-rhel8@sha256:ee47b302b5655b1a64d79ce370033956c14cfacd83b3f589f4eb153cc9201d62_arm64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-operator-bundle@sha256:e2cbcab60fad0718e63a8c9bacaca97d205735e968505a56ae1a1c523d5ee2da_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:45059c429a74ea709c828dcdcf0eeb481ec0c27ec82fa4c7f6a46214749e6edb_amd64",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:b1cd378eba90e9258c1639305a8bd66120220333a3cdf2df5ebfb71d1e9d7539_s390x",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:f3c1bd5157e6791f150dbe211a5ca4a391e9e69ac07748a41bb0b829e645933a_ppc64le",
"OpenShift Compliance Operator 1:registry.redhat.io/compliance/openshift-compliance-rhel8-operator@sha256:ff3573bf04e5f74c9aa62f96c349cbe3599f7623a05acc1881eb321ee5d93487_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation"
}
]
}
FKIE_CVE-2026-4645
Vulnerability from fkie_nvd - Published: 2026-03-23 14:16 - Updated: 2026-03-30 08:16
Severity ?
Summary
Rejected reason: Duplicate of CVE-2026-32287
References
| URL | Tags |
|---|
Impacted products
| Vendor | Product | Version |
|---|
{
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Rejected reason: Duplicate of CVE-2026-32287"
}
],
"id": "CVE-2026-4645",
"lastModified": "2026-03-30T08:16:18.693",
"metrics": {},
"published": "2026-03-23T14:16:36.063",
"references": [],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Rejected"
}
GHSA-X7CQ-7PQM-2PGR
Vulnerability from github – Published: 2026-03-30 09:31 – Updated: 2026-03-30 09:31
VLAI?
Details
Rejected reason: Duplicate of CVE-2026-32287
{
"affected": [],
"aliases": [
"CVE-2026-4645"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-23T14:16:36Z",
"severity": null
},
"details": "Rejected reason: Duplicate of CVE-2026-32287",
"id": "GHSA-x7cq-7pqm-2pgr",
"modified": "2026-03-30T09:31:28Z",
"published": "2026-03-30T09:31:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4645"
}
],
"schema_version": "1.4.0",
"severity": []
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…