RHSA-2026:10065

Vulnerability from csaf_redhat - Published: 2026-04-23 06:06 - Updated: 2026-04-23 06:08
Summary
Red Hat Security Advisory: Red Hat Update Infrastructure 5.1 security update
Severity
Important
Notes
Topic: The latest release of Red Hat Update Infrastructure. For more details, see the product documentation.
Details: Red Hat Update Infrastructure (RHUI) container images are based on the latest RHUI RPM packages and the ubi9 or ubi9-init base images. This release updates to the latest version.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
CVE-2023-40403

A flaw was found in libxslt package. Processing web content may disclose sensitive information. This issue was addressed with improved memory handling.

6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Vendor Fix The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility. See the official documentation for more details. https://access.redhat.com/errata/RHSA-2026:10065
CVE-2026-1642

A flaw was found in NGINX. When NGINX is configured to proxy to upstream Transport Layer Security (TLS) servers, An attacker with a man-in-the-middle (MITM) position on the upstream server side—along with conditions beyond the attacker's control—may be able to inject plain text data into the response from an upstream proxied server.

5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE-349 - Acceptance of Extraneous Untrusted Data With Trusted Data
Vendor Fix The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility. See the official documentation for more details. https://access.redhat.com/errata/RHSA-2026:10065
Workaround Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
CVE-2026-3497

A flaw was found in the OpenSSH GSSAPI (Generic Security Service Application Program Interface) delta patches, as included in various Linux distributions. A remote attacker could exploit this by sending an unexpected GSSAPI message type during the key exchange process. This occurs because the `sshpkt_disconnect()` function, when called on an error, does not properly terminate the process, leading to the continued execution of the program with uninitialized connection variables. Accessing these uninitialized variables can lead to undefined behavior, potentially resulting in information disclosure or a denial of service.

8.2 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
CWE-824 - Access of Uninitialized Pointer
Vendor Fix The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility. See the official documentation for more details. https://access.redhat.com/errata/RHSA-2026:10065
Workaround To mitigate this issue, disable GSSAPI key exchange in the OpenSSH server configuration. This prevents the server from processing GSSAPI messages, eliminating the vulnerability's attack surface. Edit `/etc/ssh/sshd_config` and add or modify the line: ``` GSSAPIKeyExchange no ``` After saving the changes, restart the `sshd` service for the mitigation to take effect. This action will prevent users from authenticating via GSSAPI. ``` # systemctl restart sshd ```
CVE-2026-4111

A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically within the archive_read_data() processing path. When a specially crafted RAR5 archive is processed, the decompression routine may enter a state where internal logic prevents forward progress. This condition results in an infinite loop that continuously consumes CPU resources. Because the archive passes checksum validation and appears structurally valid, affected applications cannot detect the issue before processing. This can allow attackers to cause persistent denial-of-service conditions in services that automatically process archives.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
Vendor Fix The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility. See the official documentation for more details. https://access.redhat.com/errata/RHSA-2026:10065
Workaround Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
CVE-2026-4424

A flaw was found in libarchive. This heap out-of-bounds read vulnerability exists in the RAR archive processing logic due to improper validation of the LZSS sliding window size after transitions between compression methods. A remote attacker can exploit this by providing a specially crafted RAR archive, leading to the disclosure of sensitive heap memory information without requiring authentication or user interaction.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-125 - Out-of-bounds Read
Vendor Fix The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility. See the official documentation for more details. https://access.redhat.com/errata/RHSA-2026:10065
Workaround Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
CVE-2026-4519

A flaw was found in Python. The `webbrowser.open()` API, used to launch web browsers, does not properly sanitize input. This allows a remote attacker to craft a malicious URL containing leading dashes. When such a URL is opened, certain web browsers may interpret these dashes as command-line options, which could lead to unexpected behavior, information disclosure, or potentially arbitrary code execution, impacting the integrity of the system.

7.1 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L
CWE-88 - Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Vendor Fix The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility. See the official documentation for more details. https://access.redhat.com/errata/RHSA-2026:10065
Workaround Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
CVE-2026-5121

A flaw was found in libarchive. On 32-bit systems, an integer overflow vulnerability exists in the zisofs block pointer allocation logic. A remote attacker can exploit this by providing a specially crafted ISO9660 image, which can lead to a heap buffer overflow. This could potentially allow for arbitrary code execution on the affected system.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-190 - Integer Overflow or Wraparound
Vendor Fix The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility. See the official documentation for more details. https://access.redhat.com/errata/RHSA-2026:10065
Workaround To mitigate this issue, avoid processing untrusted ISO9660 images with applications that utilize `libarchive`. Users should only extract or read content from ISO images obtained from trusted sources.
CVE-2026-25679

The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-1286 - Improper Validation of Syntactic Correctness of Input
Vendor Fix The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility. See the official documentation for more details. https://access.redhat.com/errata/RHSA-2026:10065
Workaround Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
CVE-2026-25749

A flaw was found in Vim, an open source, command line text editor. This heap buffer overflow vulnerability exists in the tag file resolution logic when processing the 'helpfile' option. A local user could exploit this by providing a specially crafted 'helpfile' option value, leading to a heap buffer overflow. This could result in arbitrary code execution or a denial of service.

7.3 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Vendor Fix The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility. See the official documentation for more details. https://access.redhat.com/errata/RHSA-2026:10065
Workaround Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
CVE-2026-27135

A flaw was found in nghttp2. Due to missing internal state validation, the library continues to process incoming data even after a session has been terminated. A remote attacker could exploit this by sending a specially crafted HTTP/2 frame, leading to an assertion failure and a denial of service (DoS).

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-617 - Reachable Assertion
Vendor Fix The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility. See the official documentation for more details. https://access.redhat.com/errata/RHSA-2026:10065
CVE-2026-27651

A flaw was found in NGINX, specifically within the ngx_mail_auth_http_module. When this module is enabled, and CRAM-MD5 or APOP authentication is active with an authentication server that permits retries, undisclosed requests can cause NGINX worker processes to terminate. This can lead to a Denial of Service (DoS), making the affected NGINX instance unavailable to legitimate users.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-476 - NULL Pointer Dereference
Vendor Fix The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility. See the official documentation for more details. https://access.redhat.com/errata/RHSA-2026:10065
Workaround Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
CVE-2026-27654

A flaw was found in NGINX. A remote attacker can exploit a buffer overflow vulnerability within the ngx_http_dav_module module. This occurs when the NGINX configuration uses DAV module MOVE or COPY methods in conjunction with prefix location and alias directives. Successful exploitation may lead to the termination of the NGINX worker process, resulting in a Denial of Service (DoS), or allow for the modification of source or destination file names outside the intended document root.

8.2 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Vendor Fix The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility. See the official documentation for more details. https://access.redhat.com/errata/RHSA-2026:10065
Workaround Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
CVE-2026-27784

A flaw was found in NGINX Open Source, specifically within the ngx_http_mp4_module. An attacker can exploit this memory corruption vulnerability by providing a specially crafted MP4 file. This can lead to an over-read or over-write of NGINX worker memory, causing the worker to terminate and resulting in a Denial of Service (DoS). This issue affects 32-bit NGINX Open Source when built with the ngx_http_mp4_module and the mp4 directive is used.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-190 - Integer Overflow or Wraparound
Vendor Fix The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility. See the official documentation for more details. https://access.redhat.com/errata/RHSA-2026:10065
Workaround Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
CVE-2026-28417

A flaw was found in Vim, an open-source command-line text editor. Specifically, an operating system (OS) command injection vulnerability exists in the `netrw` standard plugin. A remote attacker could exploit this by tricking a user into opening a specially crafted URL, such as one using the `scp://` protocol handler. Successful exploitation allows the attacker to execute arbitrary shell commands with the same privileges as the Vim process, leading to potential system compromise.

4.4 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vendor Fix The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility. See the official documentation for more details. https://access.redhat.com/errata/RHSA-2026:10065
Workaround Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
CVE-2026-28421

A flaw was found in Vim. This vulnerability, a heap-buffer-overflow and a segmentation fault, exists in the swap file recovery logic. A local attacker could exploit this by providing a specially crafted swap file. This could lead to a denial of service (DoS) or potentially information disclosure.

5.3 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Vendor Fix The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility. See the official documentation for more details. https://access.redhat.com/errata/RHSA-2026:10065
Workaround Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
CVE-2026-32647

A flaw was found in NGINX's ngx_http_mp4_module. This Out-of-Bounds Read/Write vulnerability occurs due to improper handling of specially crafted MP4 files. A local authenticated attacker, by supplying a malicious MP4 file, can trigger a buffer over-read or overwrite in worker memory. This can lead to process termination, potentially causing a denial-of-service or, under certain conditions, achieving code execution.

7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-125 - Out-of-bounds Read
Vendor Fix The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility. See the official documentation for more details. https://access.redhat.com/errata/RHSA-2026:10065
Workaround To mitigate this issue, disable the ngx_http_mp4_module in your NGINX configuration if MP4 file processing is not required. This can be done by commenting out or removing the mp4 directive from the NGINX configuration file. After modifying the configuration, a reload or restart of the NGINX service is required for the changes to take effect. Alternatively, restrict access to the NGINX server to trusted networks and users to prevent the upload and processing of malicious MP4 files.
CVE-2026-33412

A flaw was found in Vim. By including a newline character in a pattern passed to Vim's glob() function, an attacker may be able to execute arbitrary shell commands. This command injection vulnerability allows for arbitrary code execution, depending on the user's shell settings.

7.3 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vendor Fix The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility. See the official documentation for more details. https://access.redhat.com/errata/RHSA-2026:10065
References
https://access.redhat.com/errata/RHSA-2026:10065 self
https://access.redhat.com/products/red-hat-update… external
https://access.redhat.com/security/cve/CVE-2023-40403 external
https://access.redhat.com/security/cve/CVE-2026-1642 external
https://access.redhat.com/security/cve/CVE-2026-25679 external
https://access.redhat.com/security/cve/CVE-2026-25749 external
https://access.redhat.com/security/cve/CVE-2026-27135 external
https://access.redhat.com/security/cve/CVE-2026-27651 external
https://access.redhat.com/security/cve/CVE-2026-27654 external
https://access.redhat.com/security/cve/CVE-2026-27784 external
https://access.redhat.com/security/cve/CVE-2026-28417 external
https://access.redhat.com/security/cve/CVE-2026-28421 external
https://access.redhat.com/security/cve/CVE-2026-32647 external
https://access.redhat.com/security/cve/CVE-2026-33412 external
https://access.redhat.com/security/cve/CVE-2026-3497 external
https://access.redhat.com/security/cve/CVE-2026-4111 external
https://access.redhat.com/security/cve/CVE-2026-4424 external
https://access.redhat.com/security/cve/CVE-2026-4519 external
https://access.redhat.com/security/cve/CVE-2026-5121 external
https://access.redhat.com/security/updates/classi… external
https://docs.redhat.com/en/documentation/red_hat_… external
https://security.access.redhat.com/data/csaf/v2/a… self
https://access.redhat.com/security/cve/CVE-2023-40403 self
https://bugzilla.redhat.com/show_bug.cgi?id=2349766 external
https://www.cve.org/CVERecord?id=CVE-2023-40403 external
https://nvd.nist.gov/vuln/detail/CVE-2023-40403 external
http://seclists.org/fulldisclosure/2023/Oct/10 external
http://seclists.org/fulldisclosure/2023/Oct/3 external
http://seclists.org/fulldisclosure/2023/Oct/4 external
http://seclists.org/fulldisclosure/2023/Oct/5 external
http://seclists.org/fulldisclosure/2023/Oct/6 external
http://seclists.org/fulldisclosure/2023/Oct/8 external
http://seclists.org/fulldisclosure/2023/Oct/9 external
https://bugs.chromium.org/p/chromium/issues/detai… external
https://bugzilla.gnome.org/show_bug.cgi?id=751621 external
https://gitlab.gnome.org/GNOME/libxslt/-/issues/94 external
https://support.apple.com/en-us/HT213927 external
https://access.redhat.com/security/cve/CVE-2026-1642 self
https://bugzilla.redhat.com/show_bug.cgi?id=2436738 external
https://www.cve.org/CVERecord?id=CVE-2026-1642 external
https://nvd.nist.gov/vuln/detail/CVE-2026-1642 external
https://my.f5.com/manage/s/article/K000159824 external
https://access.redhat.com/security/cve/CVE-2026-3497 self
https://bugzilla.redhat.com/show_bug.cgi?id=2447085 external
https://www.cve.org/CVERecord?id=CVE-2026-3497 external
https://nvd.nist.gov/vuln/detail/CVE-2026-3497 external
https://ubuntu.com/security/CVE-2026-3497 external
https://www.openwall.com/lists/oss-security/2026/… external
https://access.redhat.com/security/cve/CVE-2026-4111 self
https://bugzilla.redhat.com/show_bug.cgi?id=2446453 external
https://www.cve.org/CVERecord?id=CVE-2026-4111 external
https://nvd.nist.gov/vuln/detail/CVE-2026-4111 external
https://github.com/libarchive/libarchive/pull/2877 external
https://access.redhat.com/security/cve/CVE-2026-4424 self
https://bugzilla.redhat.com/show_bug.cgi?id=2449006 external
https://www.cve.org/CVERecord?id=CVE-2026-4424 external
https://nvd.nist.gov/vuln/detail/CVE-2026-4424 external
https://github.com/libarchive/libarchive/pull/2898 external
https://access.redhat.com/security/cve/CVE-2026-4519 self
https://bugzilla.redhat.com/show_bug.cgi?id=2449649 external
https://www.cve.org/CVERecord?id=CVE-2026-4519 external
https://nvd.nist.gov/vuln/detail/CVE-2026-4519 external
https://github.com/python/cpython/issues/143930 external
https://github.com/python/cpython/pull/143931 external
https://mail.python.org/archives/list/security-an… external
https://access.redhat.com/security/cve/CVE-2026-5121 self
https://bugzilla.redhat.com/show_bug.cgi?id=2452945 external
https://www.cve.org/CVERecord?id=CVE-2026-5121 external
https://nvd.nist.gov/vuln/detail/CVE-2026-5121 external
https://github.com/advisories/GHSA-2vwv-vqpv-v8vc external
https://github.com/libarchive/libarchive/pull/2934 external
https://access.redhat.com/security/cve/CVE-2026-25679 self
https://bugzilla.redhat.com/show_bug.cgi?id=2445356 external
https://www.cve.org/CVERecord?id=CVE-2026-25679 external
https://nvd.nist.gov/vuln/detail/CVE-2026-25679 external
https://go.dev/cl/752180 external
https://go.dev/issue/77578 external
https://groups.google.com/g/golang-announce/c/Edh… external
https://pkg.go.dev/vuln/GO-2026-4601 external
https://access.redhat.com/security/cve/CVE-2026-25749 self
https://bugzilla.redhat.com/show_bug.cgi?id=2437843 external
https://www.cve.org/CVERecord?id=CVE-2026-25749 external
https://nvd.nist.gov/vuln/detail/CVE-2026-25749 external
https://github.com/vim/vim/commit/0714b15940b2451… external
https://github.com/vim/vim/releases/tag/v9.1.2132 external
https://github.com/vim/vim/security/advisories/GH… external
https://access.redhat.com/security/cve/CVE-2026-27135 self
https://bugzilla.redhat.com/show_bug.cgi?id=2448754 external
https://www.cve.org/CVERecord?id=CVE-2026-27135 external
https://nvd.nist.gov/vuln/detail/CVE-2026-27135 external
https://github.com/nghttp2/nghttp2/commit/5c7df8f… external
https://github.com/nghttp2/nghttp2/security/advis… external
https://access.redhat.com/security/cve/CVE-2026-27651 self
https://bugzilla.redhat.com/show_bug.cgi?id=2450791 external
https://www.cve.org/CVERecord?id=CVE-2026-27651 external
https://nvd.nist.gov/vuln/detail/CVE-2026-27651 external
https://my.f5.com/manage/s/article/K000160383 external
https://access.redhat.com/security/cve/CVE-2026-27654 self
https://bugzilla.redhat.com/show_bug.cgi?id=2450776 external
https://www.cve.org/CVERecord?id=CVE-2026-27654 external
https://nvd.nist.gov/vuln/detail/CVE-2026-27654 external
https://my.f5.com/manage/s/article/K000160382 external
https://access.redhat.com/security/cve/CVE-2026-27784 self
https://bugzilla.redhat.com/show_bug.cgi?id=2450785 external
https://www.cve.org/CVERecord?id=CVE-2026-27784 external
https://nvd.nist.gov/vuln/detail/CVE-2026-27784 external
https://my.f5.com/manage/s/article/K000160364 external
https://access.redhat.com/security/cve/CVE-2026-28417 self
https://bugzilla.redhat.com/show_bug.cgi?id=2443455 external
https://www.cve.org/CVERecord?id=CVE-2026-28417 external
https://nvd.nist.gov/vuln/detail/CVE-2026-28417 external
https://github.com/vim/vim/commit/79348dbbc093321… external
https://github.com/vim/vim/releases/tag/v9.2.0073 external
https://github.com/vim/vim/security/advisories/GH… external
https://access.redhat.com/security/cve/CVE-2026-28421 self
https://bugzilla.redhat.com/show_bug.cgi?id=2443474 external
https://www.cve.org/CVERecord?id=CVE-2026-28421 external
https://nvd.nist.gov/vuln/detail/CVE-2026-28421 external
https://github.com/vim/vim/commit/65c1a143c331c886dc28 external
https://github.com/vim/vim/releases/tag/v9.2.0077 external
https://github.com/vim/vim/security/advisories/GH… external
https://access.redhat.com/security/cve/CVE-2026-32647 self
https://bugzilla.redhat.com/show_bug.cgi?id=2449598 external
https://www.cve.org/CVERecord?id=CVE-2026-32647 external
https://nvd.nist.gov/vuln/detail/CVE-2026-32647 external
https://my.f5.com/manage/s/article/K000160366 external
https://access.redhat.com/security/cve/CVE-2026-33412 self
https://bugzilla.redhat.com/show_bug.cgi?id=2450907 external
https://www.cve.org/CVERecord?id=CVE-2026-33412 external
https://nvd.nist.gov/vuln/detail/CVE-2026-33412 external
https://github.com/vim/vim/commit/645ed6597d1ea89… external
https://github.com/vim/vim/releases/tag/v9.2.0202 external
https://github.com/vim/vim/security/advisories/GH… external
Acknowledgments
Elhanan Haenel
Aisle Research Pavel Kohout
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "The latest release of Red Hat Update Infrastructure. For more details, see the product documentation.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat Update Infrastructure (RHUI) container images are based on the latest RHUI RPM packages and the ubi9 or ubi9-init base images.\nThis release updates to the latest version.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:10065",
        "url": "https://access.redhat.com/errata/RHSA-2026:10065"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/products/red-hat-update-infrastructure",
        "url": "https://access.redhat.com/products/red-hat-update-infrastructure"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2023-40403",
        "url": "https://access.redhat.com/security/cve/CVE-2023-40403"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-1642",
        "url": "https://access.redhat.com/security/cve/CVE-2026-1642"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-25679",
        "url": "https://access.redhat.com/security/cve/CVE-2026-25679"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-25749",
        "url": "https://access.redhat.com/security/cve/CVE-2026-25749"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-27135",
        "url": "https://access.redhat.com/security/cve/CVE-2026-27135"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-27651",
        "url": "https://access.redhat.com/security/cve/CVE-2026-27651"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-27654",
        "url": "https://access.redhat.com/security/cve/CVE-2026-27654"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-27784",
        "url": "https://access.redhat.com/security/cve/CVE-2026-27784"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-28417",
        "url": "https://access.redhat.com/security/cve/CVE-2026-28417"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-28421",
        "url": "https://access.redhat.com/security/cve/CVE-2026-28421"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-32647",
        "url": "https://access.redhat.com/security/cve/CVE-2026-32647"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-33412",
        "url": "https://access.redhat.com/security/cve/CVE-2026-33412"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-3497",
        "url": "https://access.redhat.com/security/cve/CVE-2026-3497"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-4111",
        "url": "https://access.redhat.com/security/cve/CVE-2026-4111"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-4424",
        "url": "https://access.redhat.com/security/cve/CVE-2026-4424"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-4519",
        "url": "https://access.redhat.com/security/cve/CVE-2026-4519"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-5121",
        "url": "https://access.redhat.com/security/cve/CVE-2026-5121"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/red_hat_update_infrastructure/5",
        "url": "https://docs.redhat.com/en/documentation/red_hat_update_infrastructure/5"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_10065.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Update Infrastructure 5.1 security update",
    "tracking": {
      "current_release_date": "2026-04-23T06:08:33+00:00",
      "generator": {
        "date": "2026-04-23T06:08:33+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.7.5"
        }
      },
      "id": "RHSA-2026:10065",
      "initial_release_date": "2026-04-23T06:06:23+00:00",
      "revision_history": [
        {
          "date": "2026-04-23T06:06:23+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-04-23T06:06:26+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-04-23T06:08:33+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Update Infrastructure 5",
                "product": {
                  "name": "Red Hat Update Infrastructure 5",
                  "product_id": "Red Hat Update Infrastructure 5",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhui:5::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Update Infrastructure"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
                "product": {
                  "name": "registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
                  "product_id": "registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/cds-rhel9@sha256%3A8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930?arch=amd64\u0026repository_url=registry.redhat.io/rhui5\u0026tag=1776868774"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
                "product": {
                  "name": "registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
                  "product_id": "registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/haproxy-rhel9@sha256%3A8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709?arch=amd64\u0026repository_url=registry.redhat.io/rhui5\u0026tag=1776868744"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
                "product": {
                  "name": "registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
                  "product_id": "registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/installer-rhel9@sha256%3A8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe?arch=amd64\u0026repository_url=registry.redhat.io/rhui5\u0026tag=1776868772"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64",
                "product": {
                  "name": "registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64",
                  "product_id": "registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/rhua-rhel9@sha256%3A7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed?arch=amd64\u0026repository_url=registry.redhat.io/rhui5\u0026tag=1776868842"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64 as a component of Red Hat Update Infrastructure 5",
          "product_id": "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64"
        },
        "product_reference": "registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
        "relates_to_product_reference": "Red Hat Update Infrastructure 5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64 as a component of Red Hat Update Infrastructure 5",
          "product_id": "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64"
        },
        "product_reference": "registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
        "relates_to_product_reference": "Red Hat Update Infrastructure 5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64 as a component of Red Hat Update Infrastructure 5",
          "product_id": "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64"
        },
        "product_reference": "registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
        "relates_to_product_reference": "Red Hat Update Infrastructure 5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64 as a component of Red Hat Update Infrastructure 5",
          "product_id": "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
        },
        "product_reference": "registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64",
        "relates_to_product_reference": "Red Hat Update Infrastructure 5"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-40403",
      "cwe": {
        "id": "CWE-200",
        "name": "Exposure of Sensitive Information to an Unauthorized Actor"
      },
      "discovery_date": "2025-03-04T12:01:50.826520+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2349766"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libxslt package. Processing web content may disclose sensitive information. This issue was addressed with improved memory handling.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libxslt: Processing web content may disclose sensitive information",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This CVE is a duplicate of CVE-2022-4909.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
        ],
        "known_not_affected": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2023-40403"
        },
        {
          "category": "external",
          "summary": "RHBZ#2349766",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2349766"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2023-40403",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-40403"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-40403",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40403"
        },
        {
          "category": "external",
          "summary": "http://seclists.org/fulldisclosure/2023/Oct/10",
          "url": "http://seclists.org/fulldisclosure/2023/Oct/10"
        },
        {
          "category": "external",
          "summary": "http://seclists.org/fulldisclosure/2023/Oct/3",
          "url": "http://seclists.org/fulldisclosure/2023/Oct/3"
        },
        {
          "category": "external",
          "summary": "http://seclists.org/fulldisclosure/2023/Oct/4",
          "url": "http://seclists.org/fulldisclosure/2023/Oct/4"
        },
        {
          "category": "external",
          "summary": "http://seclists.org/fulldisclosure/2023/Oct/5",
          "url": "http://seclists.org/fulldisclosure/2023/Oct/5"
        },
        {
          "category": "external",
          "summary": "http://seclists.org/fulldisclosure/2023/Oct/6",
          "url": "http://seclists.org/fulldisclosure/2023/Oct/6"
        },
        {
          "category": "external",
          "summary": "http://seclists.org/fulldisclosure/2023/Oct/8",
          "url": "http://seclists.org/fulldisclosure/2023/Oct/8"
        },
        {
          "category": "external",
          "summary": "http://seclists.org/fulldisclosure/2023/Oct/9",
          "url": "http://seclists.org/fulldisclosure/2023/Oct/9"
        },
        {
          "category": "external",
          "summary": "https://bugs.chromium.org/p/chromium/issues/detail?id=1356211",
          "url": "https://bugs.chromium.org/p/chromium/issues/detail?id=1356211"
        },
        {
          "category": "external",
          "summary": "https://bugzilla.gnome.org/show_bug.cgi?id=751621",
          "url": "https://bugzilla.gnome.org/show_bug.cgi?id=751621"
        },
        {
          "category": "external",
          "summary": "https://gitlab.gnome.org/GNOME/libxslt/-/issues/94",
          "url": "https://gitlab.gnome.org/GNOME/libxslt/-/issues/94"
        },
        {
          "category": "external",
          "summary": "https://support.apple.com/en-us/HT213927",
          "url": "https://support.apple.com/en-us/HT213927"
        }
      ],
      "release_date": "2023-09-26T20:14:54.697000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-23T06:06:23+00:00",
          "details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:10065"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "libxslt: Processing web content may disclose sensitive information"
    },
    {
      "cve": "CVE-2026-1642",
      "cwe": {
        "id": "CWE-349",
        "name": "Acceptance of Extraneous Untrusted Data With Trusted Data"
      },
      "discovery_date": "2026-02-04T16:00:52.156255+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2436738"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in NGINX. When NGINX is configured to proxy to upstream Transport Layer Security (TLS) servers, An attacker with a man-in-the-middle (MITM) position on the upstream server side\u2014along with conditions beyond the attacker\u0027s control\u2014may be able to inject plain text data into the response from an upstream proxied server.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nginx: NGINX: Data injection via man-in-the-middle attack on TLS proxied connections",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
        ],
        "known_not_affected": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-1642"
        },
        {
          "category": "external",
          "summary": "RHBZ#2436738",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436738"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-1642",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-1642"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-1642",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1642"
        },
        {
          "category": "external",
          "summary": "https://my.f5.com/manage/s/article/K000159824",
          "url": "https://my.f5.com/manage/s/article/K000159824"
        }
      ],
      "release_date": "2026-02-04T15:02:06.154000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-23T06:06:23+00:00",
          "details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:10065"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "nginx: NGINX: Data injection via man-in-the-middle attack on TLS proxied connections"
    },
    {
      "cve": "CVE-2026-3497",
      "cwe": {
        "id": "CWE-824",
        "name": "Access of Uninitialized Pointer"
      },
      "discovery_date": "2026-03-12T19:01:37.007806+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2447085"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the OpenSSH GSSAPI (Generic Security Service Application Program Interface) delta patches, as included in various Linux distributions. A remote attacker could exploit this by sending an unexpected GSSAPI message type during the key exchange process. This occurs because the `sshpkt_disconnect()` function, when called on an error, does not properly terminate the process, leading to the continued execution of the program with uninitialized connection variables. Accessing these uninitialized variables can lead to undefined behavior, potentially resulting in information disclosure or a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssh: OpenSSH GSSAPI: Information disclosure or denial of service due to uninitialized variables",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "IMPORTANT: This vulnerability affects the OpenSSH GSSAPI delta as implemented in Red Hat Enterprise Linux and OpenShift Container Platform. An unauthenticated attacker could send a specially crafted GSSAPI message during key exchange, leading to the use of uninitialized variables and potentially undefined behavior. The severity of the impact is dependent on compiler hardening configurations.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
        ],
        "known_not_affected": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-3497"
        },
        {
          "category": "external",
          "summary": "RHBZ#2447085",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447085"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-3497",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-3497"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-3497",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3497"
        },
        {
          "category": "external",
          "summary": "https://ubuntu.com/security/CVE-2026-3497",
          "url": "https://ubuntu.com/security/CVE-2026-3497"
        },
        {
          "category": "external",
          "summary": "https://www.openwall.com/lists/oss-security/2026/03/12/3",
          "url": "https://www.openwall.com/lists/oss-security/2026/03/12/3"
        }
      ],
      "release_date": "2026-03-12T18:27:44.917000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-23T06:06:23+00:00",
          "details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:10065"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, disable GSSAPI key exchange in the OpenSSH server configuration. This prevents the server from processing GSSAPI messages, eliminating the vulnerability\u0027s attack surface.\n\nEdit `/etc/ssh/sshd_config` and add or modify the line:\n```\nGSSAPIKeyExchange no\n```\n\nAfter saving the changes, restart the `sshd` service for the mitigation to take effect. This action will prevent users from authenticating via GSSAPI.\n\n```\n# systemctl restart sshd\n```",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "openssh: OpenSSH GSSAPI: Information disclosure or denial of service due to uninitialized variables"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Elhanan Haenel"
          ]
        }
      ],
      "cve": "CVE-2026-4111",
      "cwe": {
        "id": "CWE-835",
        "name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
      },
      "discovery_date": "2026-03-11T11:18:51.609000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2446453"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically within the archive_read_data() processing path. When a specially crafted RAR5 archive is processed, the decompression routine may enter a state where internal logic prevents forward progress. This condition results in an infinite loop that continuously consumes CPU resources. Because the archive passes checksum validation and appears structurally valid, affected applications cannot detect the issue before processing. This can allow attackers to cause persistent denial-of-service conditions in services that automatically process archives.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libarchive: Infinite Loop Denial of Service in RAR5 Decompression via archive_read_data() in libarchive",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat Product Security team would likely assess the severity of this vulnerability as High because it allows remote attackers to cause a persistent denial-of-service condition using a small crafted archive file. Successful exploitation requires no authentication, no special configuration, and no user interaction in environments that automatically process uploaded archives. By repeatedly submitting malicious archives, an attacker can exhaust CPU resources or worker threads in services such as file upload systems, CI/CD pipelines, mail scanners, and content indexing services that rely on libarchive for archive extraction.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-4111"
        },
        {
          "category": "external",
          "summary": "RHBZ#2446453",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2446453"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-4111",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-4111"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4111",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4111"
        },
        {
          "category": "external",
          "summary": "https://github.com/libarchive/libarchive/pull/2877",
          "url": "https://github.com/libarchive/libarchive/pull/2877"
        }
      ],
      "release_date": "2026-03-11T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-23T06:06:23+00:00",
          "details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:10065"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "libarchive: Infinite Loop Denial of Service in RAR5 Decompression via archive_read_data() in libarchive"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Elhanan Haenel"
          ]
        }
      ],
      "cve": "CVE-2026-4424",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2026-03-19T12:22:21.740000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2449006"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libarchive. This heap out-of-bounds read vulnerability exists in the RAR archive processing logic due to improper validation of the LZSS sliding window size after transitions between compression methods. A remote attacker can exploit this by providing a specially crafted RAR archive, leading to the disclosure of sensitive heap memory information without requiring authentication or user interaction.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libarchive: libarchive: Information disclosure via heap out-of-bounds read in RAR archive processing",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "IMPORTANT: This heap out-of-bounds read vulnerability in libarchive\u0027s RAR archive processing logic can lead to information disclosure. A remote attacker can exploit this flaw by providing a specially crafted RAR archive, potentially revealing sensitive heap memory information without requiring authentication or user interaction on systems that process untrusted archives.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-4424"
        },
        {
          "category": "external",
          "summary": "RHBZ#2449006",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449006"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-4424",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-4424"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4424",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4424"
        },
        {
          "category": "external",
          "summary": "https://github.com/libarchive/libarchive/pull/2898",
          "url": "https://github.com/libarchive/libarchive/pull/2898"
        }
      ],
      "release_date": "2026-03-19T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-23T06:06:23+00:00",
          "details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:10065"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "libarchive: libarchive: Information disclosure via heap out-of-bounds read in RAR archive processing"
    },
    {
      "cve": "CVE-2026-4519",
      "cwe": {
        "id": "CWE-88",
        "name": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)"
      },
      "discovery_date": "2026-03-20T16:02:13.494105+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2449649"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Python. The `webbrowser.open()` API, used to launch web browsers, does not properly sanitize input. This allows a remote attacker to craft a malicious URL containing leading dashes. When such a URL is opened, certain web browsers may interpret these dashes as command-line options, which could lead to unexpected behavior, information disclosure, or potentially arbitrary code execution, impacting the integrity of the system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "python: Python: Command-line option injection in webbrowser.open() via crafted URLs",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-4519"
        },
        {
          "category": "external",
          "summary": "RHBZ#2449649",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449649"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-4519",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-4519"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4519",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4519"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/issues/143930",
          "url": "https://github.com/python/cpython/issues/143930"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/pull/143931",
          "url": "https://github.com/python/cpython/pull/143931"
        },
        {
          "category": "external",
          "summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/AY5NDSS433JK56Q7Q5IS7B37QFZVVOUS/",
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/AY5NDSS433JK56Q7Q5IS7B37QFZVVOUS/"
        }
      ],
      "release_date": "2026-03-20T15:08:32.576000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-23T06:06:23+00:00",
          "details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:10065"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "python: Python: Command-line option injection in webbrowser.open() via crafted URLs"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Elhanan Haenel"
          ]
        }
      ],
      "cve": "CVE-2026-5121",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "discovery_date": "2026-03-30T07:40:25.358335+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2452945"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libarchive. On 32-bit systems, an integer overflow vulnerability exists in the zisofs block pointer allocation logic. A remote attacker can exploit this by providing a specially crafted ISO9660 image, which can lead to a heap buffer overflow. This could potentially allow for arbitrary code execution on the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libarchive: libarchive: Arbitrary code execution via integer overflow in ISO9660 image processing",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Important: An integer overflow flaw in `libarchive` on 32-bit systems can lead to a heap buffer overflow. This vulnerability occurs when processing a specially crafted ISO9660 image, allowing an attacker to potentially execute arbitrary code. Red Hat Enterprise Linux 64-bit systems are not affected by this flaw.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-5121"
        },
        {
          "category": "external",
          "summary": "RHBZ#2452945",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2452945"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-5121",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-5121"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5121",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5121"
        },
        {
          "category": "external",
          "summary": "https://github.com/advisories/GHSA-2vwv-vqpv-v8vc",
          "url": "https://github.com/advisories/GHSA-2vwv-vqpv-v8vc"
        },
        {
          "category": "external",
          "summary": "https://github.com/libarchive/libarchive/pull/2934",
          "url": "https://github.com/libarchive/libarchive/pull/2934"
        }
      ],
      "release_date": "2026-03-30T07:44:15.222000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-23T06:06:23+00:00",
          "details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:10065"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, avoid processing untrusted ISO9660 images with applications that utilize `libarchive`. Users should only extract or read content from ISO images obtained from trusted sources.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "libarchive: libarchive: Arbitrary code execution via integer overflow in ISO9660 image processing"
    },
    {
      "cve": "CVE-2026-25679",
      "cwe": {
        "id": "CWE-1286",
        "name": "Improper Validation of Syntactic Correctness of Input"
      },
      "discovery_date": "2026-03-06T22:02:11.567841+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2445356"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net/url: Incorrect parsing of IPv6 host literals in net/url",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
        ],
        "known_not_affected": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-25679"
        },
        {
          "category": "external",
          "summary": "RHBZ#2445356",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445356"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-25679",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-25679"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/752180",
          "url": "https://go.dev/cl/752180"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/77578",
          "url": "https://go.dev/issue/77578"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk",
          "url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4601",
          "url": "https://pkg.go.dev/vuln/GO-2026-4601"
        }
      ],
      "release_date": "2026-03-06T21:28:14.211000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-23T06:06:23+00:00",
          "details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:10065"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "net/url: Incorrect parsing of IPv6 host literals in net/url"
    },
    {
      "cve": "CVE-2026-25749",
      "cwe": {
        "id": "CWE-120",
        "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
      },
      "discovery_date": "2026-02-09T11:08:59.061581+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2437843"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Vim, an open source, command line text editor. This heap buffer overflow vulnerability exists in the tag file resolution logic when processing the \u0027helpfile\u0027 option. A local user could exploit this by providing a specially crafted \u0027helpfile\u0027 option value, leading to a heap buffer overflow. This could result in arbitrary code execution or a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vim: Vim: Arbitrary code execution via \u0027helpfile\u0027 option processing",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This MODERATE impact vulnerability in Vim\u0027s tag file resolution logic allows a local attacker to achieve a out-of-bounds write. By providing a specially crafted `helpfile` option value a local user can trigger a heap buffer overflow, as consequence lead to memory corruption presenting a data integrity impact or leading the vim process to crash resulting in availability impact. Although being non-trivial and very complex, arbitrary code execution is not discarded as worst case scenario.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-25749"
        },
        {
          "category": "external",
          "summary": "RHBZ#2437843",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2437843"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-25749",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-25749"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25749",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25749"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/commit/0714b15940b245108e6e9d7aa2260dd849a26fa9",
          "url": "https://github.com/vim/vim/commit/0714b15940b245108e6e9d7aa2260dd849a26fa9"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/releases/tag/v9.1.2132",
          "url": "https://github.com/vim/vim/releases/tag/v9.1.2132"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/security/advisories/GHSA-5w93-4g67-mm43",
          "url": "https://github.com/vim/vim/security/advisories/GHSA-5w93-4g67-mm43"
        }
      ],
      "release_date": "2026-02-06T22:43:38.630000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-23T06:06:23+00:00",
          "details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:10065"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "vim: Vim: Arbitrary code execution via \u0027helpfile\u0027 option processing"
    },
    {
      "cve": "CVE-2026-27135",
      "cwe": {
        "id": "CWE-617",
        "name": "Reachable Assertion"
      },
      "discovery_date": "2026-03-18T19:02:13.823002+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2448754"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in nghttp2. Due to missing internal state validation, the library continues to process incoming data even after a session has been terminated. A remote attacker could exploit this by sending a specially crafted HTTP/2 frame, leading to an assertion failure and a denial of service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-27135"
        },
        {
          "category": "external",
          "summary": "RHBZ#2448754",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448754"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-27135",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-27135"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27135",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27135"
        },
        {
          "category": "external",
          "summary": "https://github.com/nghttp2/nghttp2/commit/5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1",
          "url": "https://github.com/nghttp2/nghttp2/commit/5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1"
        },
        {
          "category": "external",
          "summary": "https://github.com/nghttp2/nghttp2/security/advisories/GHSA-6933-cjhr-5qg6",
          "url": "https://github.com/nghttp2/nghttp2/security/advisories/GHSA-6933-cjhr-5qg6"
        }
      ],
      "release_date": "2026-03-18T17:59:02.045000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-23T06:06:23+00:00",
          "details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:10065"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination"
    },
    {
      "cve": "CVE-2026-27651",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "discovery_date": "2026-03-24T15:02:32.414082+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2450791"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in NGINX, specifically within the ngx_mail_auth_http_module. When this module is enabled, and CRAM-MD5 or APOP authentication is active with an authentication server that permits retries, undisclosed requests can cause NGINX worker processes to terminate. This can lead to a Denial of Service (DoS), making the affected NGINX instance unavailable to legitimate users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "NGINX: NGINX: Denial of Service via undisclosed requests when ngx_mail_auth_http_module is enabled",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
        ],
        "known_not_affected": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-27651"
        },
        {
          "category": "external",
          "summary": "RHBZ#2450791",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450791"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-27651",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-27651"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27651",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27651"
        },
        {
          "category": "external",
          "summary": "https://my.f5.com/manage/s/article/K000160383",
          "url": "https://my.f5.com/manage/s/article/K000160383"
        }
      ],
      "release_date": "2026-03-24T14:13:27.295000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-23T06:06:23+00:00",
          "details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:10065"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "NGINX: NGINX: Denial of Service via undisclosed requests when ngx_mail_auth_http_module is enabled"
    },
    {
      "cve": "CVE-2026-27654",
      "cwe": {
        "id": "CWE-120",
        "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
      },
      "discovery_date": "2026-03-24T15:01:19.814138+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2450776"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in NGINX. A remote attacker can exploit a buffer overflow vulnerability within the ngx_http_dav_module module. This occurs when the NGINX configuration uses DAV module MOVE or COPY methods in conjunction with prefix location and alias directives. Successful exploitation may lead to the termination of the NGINX worker process, resulting in a Denial of Service (DoS), or allow for the modification of source or destination file names outside the intended document root.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "NGINX: NGINX: Denial of Service or file modification via buffer overflow in ngx_http_dav_module",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
        ],
        "known_not_affected": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-27654"
        },
        {
          "category": "external",
          "summary": "RHBZ#2450776",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450776"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-27654",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-27654"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27654",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27654"
        },
        {
          "category": "external",
          "summary": "https://my.f5.com/manage/s/article/K000160382",
          "url": "https://my.f5.com/manage/s/article/K000160382"
        }
      ],
      "release_date": "2026-03-24T14:13:26.879000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-23T06:06:23+00:00",
          "details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:10065"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "NGINX: NGINX: Denial of Service or file modification via buffer overflow in ngx_http_dav_module"
    },
    {
      "cve": "CVE-2026-27784",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "discovery_date": "2026-03-24T15:02:07.092253+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2450785"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in NGINX Open Source, specifically within the ngx_http_mp4_module. An attacker can exploit this memory corruption vulnerability by providing a specially crafted MP4 file. This can lead to an over-read or over-write of NGINX worker memory, causing the worker to terminate and resulting in a Denial of Service (DoS). This issue affects 32-bit NGINX Open Source when built with the ngx_http_mp4_module and the mp4 directive is used.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "NGINX: NGINX: Denial of Service due to memory corruption via crafted MP4 file",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
        ],
        "known_not_affected": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-27784"
        },
        {
          "category": "external",
          "summary": "RHBZ#2450785",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450785"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-27784",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-27784"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27784",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27784"
        },
        {
          "category": "external",
          "summary": "https://my.f5.com/manage/s/article/K000160364",
          "url": "https://my.f5.com/manage/s/article/K000160364"
        }
      ],
      "release_date": "2026-03-24T14:13:25.343000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-23T06:06:23+00:00",
          "details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:10065"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "NGINX: NGINX: Denial of Service due to memory corruption via crafted MP4 file"
    },
    {
      "cve": "CVE-2026-28417",
      "cwe": {
        "id": "CWE-78",
        "name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
      },
      "discovery_date": "2026-02-27T22:01:53.728412+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2443455"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Vim, an open-source command-line text editor. Specifically, an operating system (OS) command injection vulnerability exists in the `netrw` standard plugin. A remote attacker could exploit this by tricking a user into opening a specially crafted URL, such as one using the `scp://` protocol handler. Successful exploitation allows the attacker to execute arbitrary shell commands with the same privileges as the Vim process, leading to potential system compromise.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vim: Vim: Arbitrary code execution via OS command injection in the netrw plugin",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The risk posed by this vulnerability is limited on Red Hat products due to user and system isolation features which are enabled by default. The impacts of this flaw will be limited by the active user\u0027s permissions and access control limits. Host systems are not at risk when following Red Hat guidelines and the root user account is not actively executing Vim.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-28417"
        },
        {
          "category": "external",
          "summary": "RHBZ#2443455",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2443455"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-28417",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-28417"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-28417",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28417"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/commit/79348dbbc09332130f4c860",
          "url": "https://github.com/vim/vim/commit/79348dbbc09332130f4c860"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/releases/tag/v9.2.0073",
          "url": "https://github.com/vim/vim/releases/tag/v9.2.0073"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/security/advisories/GHSA-m3xh-9434-g336",
          "url": "https://github.com/vim/vim/security/advisories/GHSA-m3xh-9434-g336"
        }
      ],
      "release_date": "2026-02-27T21:54:35.196000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-23T06:06:23+00:00",
          "details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:10065"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "vim: Vim: Arbitrary code execution via OS command injection in the netrw plugin"
    },
    {
      "cve": "CVE-2026-28421",
      "cwe": {
        "id": "CWE-120",
        "name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
      },
      "discovery_date": "2026-02-27T23:01:44.673504+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2443474"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Vim. This vulnerability, a heap-buffer-overflow and a segmentation fault, exists in the swap file recovery logic. A local attacker could exploit this by providing a specially crafted swap file. This could lead to a denial of service (DoS) or potentially information disclosure.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vim: Vim: Denial of service and information disclosure via crafted swap file",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The risk posed by this vulnerability is limited on Red Hat products due to user and system isolation features which are enabled by default. The impacts of this flaw will be limited by the active user\u0027s permissions and access control limits. Host systems are not at risk when following Red Hat guidelines and the root user account is not actively executing Vim.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-28421"
        },
        {
          "category": "external",
          "summary": "RHBZ#2443474",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2443474"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-28421",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-28421"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-28421",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28421"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/commit/65c1a143c331c886dc28",
          "url": "https://github.com/vim/vim/commit/65c1a143c331c886dc28"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/releases/tag/v9.2.0077",
          "url": "https://github.com/vim/vim/releases/tag/v9.2.0077"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/security/advisories/GHSA-r2gw-2x48-jj5p",
          "url": "https://github.com/vim/vim/security/advisories/GHSA-r2gw-2x48-jj5p"
        }
      ],
      "release_date": "2026-02-27T22:06:34.312000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-23T06:06:23+00:00",
          "details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:10065"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "vim: Vim: Denial of service and information disclosure via crafted swap file"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Pavel Kohout"
          ],
          "organization": "Aisle Research"
        }
      ],
      "cve": "CVE-2026-32647",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2026-03-20T11:44:34.715000+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2449598"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in NGINX\u0027s ngx_http_mp4_module. This Out-of-Bounds Read/Write vulnerability occurs due to improper handling of specially crafted MP4 files. A local authenticated attacker, by supplying a malicious MP4 file, can trigger a buffer over-read or overwrite in worker memory. This can lead to process termination, potentially causing a denial-of-service or, under certain conditions, achieving code execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nginx: NGINX: Denial of Service or Code Execution via specially crafted MP4 files",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This IMPORTANT vulnerability in the NGINX ngx_http_mp4_module is due to improper handling of specially crafted MP4 files. A local authenticated attacker could exploit this flaw by providing a malicious MP4 file, leading to a denial of service or potentially arbitrary code execution. Red Hat products utilizing NGINX with the ngx_http_mp4_module enabled are affected if untrusted MP4 files are processed.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
        ],
        "known_not_affected": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-32647"
        },
        {
          "category": "external",
          "summary": "RHBZ#2449598",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449598"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-32647",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-32647"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32647",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32647"
        },
        {
          "category": "external",
          "summary": "https://my.f5.com/manage/s/article/K000160366",
          "url": "https://my.f5.com/manage/s/article/K000160366"
        }
      ],
      "release_date": "2026-03-24T18:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-23T06:06:23+00:00",
          "details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:10065"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, disable the ngx_http_mp4_module in your NGINX configuration if MP4 file processing is not required. This can be done by commenting out or removing the mp4 directive from the NGINX configuration file. After modifying the configuration, a reload or restart of the NGINX service is required for the changes to take effect.\n\nAlternatively, restrict access to the NGINX server to trusted networks and users to prevent the upload and processing of malicious MP4 files.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "nginx: NGINX: Denial of Service or Code Execution via specially crafted MP4 files"
    },
    {
      "cve": "CVE-2026-33412",
      "cwe": {
        "id": "CWE-78",
        "name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
      },
      "discovery_date": "2026-03-24T20:02:21.511965+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2450907"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Vim. By including a newline character in a pattern passed to Vim\u0027s glob() function, an attacker may be able to execute arbitrary shell commands. This command injection vulnerability allows for arbitrary code execution, depending on the user\u0027s shell settings.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vim: Vim: Arbitrary code execution via command injection in glob() function",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
          "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-33412"
        },
        {
          "category": "external",
          "summary": "RHBZ#2450907",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450907"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-33412",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-33412"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33412",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33412"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/commit/645ed6597d1ea896c712cd7ddbb6edee79577e9a",
          "url": "https://github.com/vim/vim/commit/645ed6597d1ea896c712cd7ddbb6edee79577e9a"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/releases/tag/v9.2.0202",
          "url": "https://github.com/vim/vim/releases/tag/v9.2.0202"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/security/advisories/GHSA-w5jw-f54h-x46c",
          "url": "https://github.com/vim/vim/security/advisories/GHSA-w5jw-f54h-x46c"
        }
      ],
      "release_date": "2026-03-24T19:43:07.219000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-04-23T06:06:23+00:00",
          "details": "The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.\nSee the official documentation for more details.",
          "product_ids": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:10065"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/cds-rhel9@sha256:8ac1507077086484155f94d2289df0f1d22bfe8f5f15589d6b354f11fe21d930_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/haproxy-rhel9@sha256:8e13332d210961a93746eb0bd3761fa220dc710aada98b121320184aef2e5709_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/installer-rhel9@sha256:8fbf461b33717d3463e4f802b1a257b7e43d60c3e9568f710df83db36a04a4fe_amd64",
            "Red Hat Update Infrastructure 5:registry.redhat.io/rhui5/rhua-rhel9@sha256:7eae5b16539484129c6ce169b41a3e1da7d7dd1296d2677acf7e9c3d1bce00ed_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "vim: Vim: Arbitrary code execution via command injection in glob() function"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.