Vulnerability-Lookup

RHSA-2026:2500

Vulnerability from csaf_redhat - Published: 2026-02-11 05:02 - Updated: 2026-02-12 20:51

Summary

Red Hat Security Advisory: Red Hat multicluster global hub 1.4.4 security update

Notes

Topic

Red Hat multicluster global hub v1.4.4 general availability release images, which provide security fixes, bug fixes, and updated container images. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References section.

Details

Red Hat multicluster global hub is a set of components that enable you to import one or more hub clusters and manage them from a single hub cluster.

This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat multicluster global hub v1.4.4 general availability release images, which provide security fixes, bug fixes, and updated container images.\n\nRed Hat Product Security has rated this update as having a security impact of Important. \nA Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat multicluster global hub is a set of components that enable you to import one or more hub clusters and manage them from a single hub cluster.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:2500",
        "url": "https://access.redhat.com/errata/RHSA-2026:2500"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-12816",
        "url": "https://access.redhat.com/security/cve/CVE-2025-12816"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-15284",
        "url": "https://access.redhat.com/security/cve/CVE-2025-15284"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-66418",
        "url": "https://access.redhat.com/security/cve/CVE-2025-66418"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-66471",
        "url": "https://access.redhat.com/security/cve/CVE-2025-66471"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-68429",
        "url": "https://access.redhat.com/security/cve/CVE-2025-68429"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-21441",
        "url": "https://access.redhat.com/security/cve/CVE-2026-21441"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_2500.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat multicluster global hub 1.4.4 security update",
    "tracking": {
      "current_release_date": "2026-02-12T20:51:42+00:00",
      "generator": {
        "date": "2026-02-12T20:51:42+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.7.1"
        }
      },
      "id": "RHSA-2026:2500",
      "initial_release_date": "2026-02-11T05:02:44+00:00",
      "revision_history": [
        {
          "date": "2026-02-11T05:02:44+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-02-11T05:02:55+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-02-12T20:51:42+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat multicluster global hub 1.4.4",
                "product": {
                  "name": "Red Hat multicluster global hub 1.4.4",
                  "product_id": "Red Hat multicluster global hub 1.4.4",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:multicluster_globalhub:1.4::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat multicluster global hub"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:945a8497173aaba167a71fb4a393714905dd2d00ede0a4eb09c00c4c59727414_amd64",
                "product": {
                  "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:945a8497173aaba167a71fb4a393714905dd2d00ede0a4eb09c00c4c59727414_amd64",
                  "product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:945a8497173aaba167a71fb4a393714905dd2d00ede0a4eb09c00c4c59727414_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/multicluster-globalhub-grafana-rhel9@sha256%3A945a8497173aaba167a71fb4a393714905dd2d00ede0a4eb09c00c4c59727414?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-globalhub\u0026tag=1770126537"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:bca34c5ced99ce0605bb8ff276e99030c480adf8842f038876095669a0d46f7e_amd64",
                "product": {
                  "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:bca34c5ced99ce0605bb8ff276e99030c480adf8842f038876095669a0d46f7e_amd64",
                  "product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:bca34c5ced99ce0605bb8ff276e99030c480adf8842f038876095669a0d46f7e_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/multicluster-globalhub-agent-rhel9@sha256%3Abca34c5ced99ce0605bb8ff276e99030c480adf8842f038876095669a0d46f7e?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-globalhub\u0026tag=1770281189"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ca7cc3adb829b0e1526c8dd4494747ed3f0b38dabdc1d9e5b67c967e4db3fb09_amd64",
                "product": {
                  "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ca7cc3adb829b0e1526c8dd4494747ed3f0b38dabdc1d9e5b67c967e4db3fb09_amd64",
                  "product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ca7cc3adb829b0e1526c8dd4494747ed3f0b38dabdc1d9e5b67c967e4db3fb09_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/multicluster-globalhub-manager-rhel9@sha256%3Aca7cc3adb829b0e1526c8dd4494747ed3f0b38dabdc1d9e5b67c967e4db3fb09?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-globalhub\u0026tag=1770280963"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:f8f73e9cadc8c27f13fd947422aa74908f0cc15eb4a340bc110db757a43c6c6e_amd64",
                "product": {
                  "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:f8f73e9cadc8c27f13fd947422aa74908f0cc15eb4a340bc110db757a43c6c6e_amd64",
                  "product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:f8f73e9cadc8c27f13fd947422aa74908f0cc15eb4a340bc110db757a43c6c6e_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/multicluster-globalhub-operator-bundle@sha256%3Af8f73e9cadc8c27f13fd947422aa74908f0cc15eb4a340bc110db757a43c6c6e?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-globalhub\u0026tag=1770362687"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5b68ff2c13f4b8670d68ecf73607ea175b168d8eab620c8c666244d3a4d0b209_amd64",
                "product": {
                  "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5b68ff2c13f4b8670d68ecf73607ea175b168d8eab620c8c666244d3a4d0b209_amd64",
                  "product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5b68ff2c13f4b8670d68ecf73607ea175b168d8eab620c8c666244d3a4d0b209_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/multicluster-globalhub-rhel9-operator@sha256%3A5b68ff2c13f4b8670d68ecf73607ea175b168d8eab620c8c666244d3a4d0b209?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-globalhub\u0026tag=1770281560"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c48153736d4573aa3cb6f2428fd10d1c08643cb69bc93d42512f561739243bed_amd64",
                "product": {
                  "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c48153736d4573aa3cb6f2428fd10d1c08643cb69bc93d42512f561739243bed_amd64",
                  "product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c48153736d4573aa3cb6f2428fd10d1c08643cb69bc93d42512f561739243bed_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/multicluster-globalhub-postgres-exporter-rhel9@sha256%3Ac48153736d4573aa3cb6f2428fd10d1c08643cb69bc93d42512f561739243bed?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-globalhub\u0026tag=1769643304"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:29f466fffff1ebdb03c69b57e588d1359324280c82c67788195048aed9e022f5_ppc64le",
                "product": {
                  "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:29f466fffff1ebdb03c69b57e588d1359324280c82c67788195048aed9e022f5_ppc64le",
                  "product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:29f466fffff1ebdb03c69b57e588d1359324280c82c67788195048aed9e022f5_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/multicluster-globalhub-grafana-rhel9@sha256%3A29f466fffff1ebdb03c69b57e588d1359324280c82c67788195048aed9e022f5?arch=ppc64le\u0026repository_url=registry.redhat.io/multicluster-globalhub\u0026tag=1770126537"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c50c3087b6579a76a07038c59dd685e767ba633428d45a057247054cd5d15e19_ppc64le",
                "product": {
                  "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c50c3087b6579a76a07038c59dd685e767ba633428d45a057247054cd5d15e19_ppc64le",
                  "product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c50c3087b6579a76a07038c59dd685e767ba633428d45a057247054cd5d15e19_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/multicluster-globalhub-agent-rhel9@sha256%3Ac50c3087b6579a76a07038c59dd685e767ba633428d45a057247054cd5d15e19?arch=ppc64le\u0026repository_url=registry.redhat.io/multicluster-globalhub\u0026tag=1770281189"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:64b490a5a70c31874ba08fbe3ac00f8be2ad74198692432a8ee4762b25e40294_ppc64le",
                "product": {
                  "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:64b490a5a70c31874ba08fbe3ac00f8be2ad74198692432a8ee4762b25e40294_ppc64le",
                  "product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:64b490a5a70c31874ba08fbe3ac00f8be2ad74198692432a8ee4762b25e40294_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/multicluster-globalhub-manager-rhel9@sha256%3A64b490a5a70c31874ba08fbe3ac00f8be2ad74198692432a8ee4762b25e40294?arch=ppc64le\u0026repository_url=registry.redhat.io/multicluster-globalhub\u0026tag=1770280963"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:9294e8c4a557d7c03108170a1406ca27e390c77bb71711de54567fa4830f91e7_ppc64le",
                "product": {
                  "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:9294e8c4a557d7c03108170a1406ca27e390c77bb71711de54567fa4830f91e7_ppc64le",
                  "product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:9294e8c4a557d7c03108170a1406ca27e390c77bb71711de54567fa4830f91e7_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/multicluster-globalhub-rhel9-operator@sha256%3A9294e8c4a557d7c03108170a1406ca27e390c77bb71711de54567fa4830f91e7?arch=ppc64le\u0026repository_url=registry.redhat.io/multicluster-globalhub\u0026tag=1770281560"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:90aee1f2623f5fb562d1badfbaa9cd993d67642ef3fe6abe523335c6e13df641_ppc64le",
                "product": {
                  "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:90aee1f2623f5fb562d1badfbaa9cd993d67642ef3fe6abe523335c6e13df641_ppc64le",
                  "product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:90aee1f2623f5fb562d1badfbaa9cd993d67642ef3fe6abe523335c6e13df641_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/multicluster-globalhub-postgres-exporter-rhel9@sha256%3A90aee1f2623f5fb562d1badfbaa9cd993d67642ef3fe6abe523335c6e13df641?arch=ppc64le\u0026repository_url=registry.redhat.io/multicluster-globalhub\u0026tag=1769643304"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:2630957b6783b2bf14940c9a153f25e68b2f4f2cdd17f2ed3a23c284b8d71aca_s390x",
                "product": {
                  "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:2630957b6783b2bf14940c9a153f25e68b2f4f2cdd17f2ed3a23c284b8d71aca_s390x",
                  "product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:2630957b6783b2bf14940c9a153f25e68b2f4f2cdd17f2ed3a23c284b8d71aca_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/multicluster-globalhub-grafana-rhel9@sha256%3A2630957b6783b2bf14940c9a153f25e68b2f4f2cdd17f2ed3a23c284b8d71aca?arch=s390x\u0026repository_url=registry.redhat.io/multicluster-globalhub\u0026tag=1770126537"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6bce9f138d78cd05a30d427afbd6fec50211ae3cba1174f796ec618c8862d8c7_s390x",
                "product": {
                  "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6bce9f138d78cd05a30d427afbd6fec50211ae3cba1174f796ec618c8862d8c7_s390x",
                  "product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6bce9f138d78cd05a30d427afbd6fec50211ae3cba1174f796ec618c8862d8c7_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/multicluster-globalhub-agent-rhel9@sha256%3A6bce9f138d78cd05a30d427afbd6fec50211ae3cba1174f796ec618c8862d8c7?arch=s390x\u0026repository_url=registry.redhat.io/multicluster-globalhub\u0026tag=1770281189"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:265f3e651d16fb5416604e7b1dad78d1214f71001f6ac3a33b081d78116f616c_s390x",
                "product": {
                  "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:265f3e651d16fb5416604e7b1dad78d1214f71001f6ac3a33b081d78116f616c_s390x",
                  "product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:265f3e651d16fb5416604e7b1dad78d1214f71001f6ac3a33b081d78116f616c_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/multicluster-globalhub-manager-rhel9@sha256%3A265f3e651d16fb5416604e7b1dad78d1214f71001f6ac3a33b081d78116f616c?arch=s390x\u0026repository_url=registry.redhat.io/multicluster-globalhub\u0026tag=1770280963"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e8e63947b14543af7407ec3b4639df3f7fe52198b771473670309c00d6ca8733_s390x",
                "product": {
                  "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e8e63947b14543af7407ec3b4639df3f7fe52198b771473670309c00d6ca8733_s390x",
                  "product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e8e63947b14543af7407ec3b4639df3f7fe52198b771473670309c00d6ca8733_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/multicluster-globalhub-rhel9-operator@sha256%3Ae8e63947b14543af7407ec3b4639df3f7fe52198b771473670309c00d6ca8733?arch=s390x\u0026repository_url=registry.redhat.io/multicluster-globalhub\u0026tag=1770281560"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c24477a58cd87093ac8d47ae89170cc9df4c317f85e86a0a638e2cb62c96644_s390x",
                "product": {
                  "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c24477a58cd87093ac8d47ae89170cc9df4c317f85e86a0a638e2cb62c96644_s390x",
                  "product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c24477a58cd87093ac8d47ae89170cc9df4c317f85e86a0a638e2cb62c96644_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/multicluster-globalhub-postgres-exporter-rhel9@sha256%3A1c24477a58cd87093ac8d47ae89170cc9df4c317f85e86a0a638e2cb62c96644?arch=s390x\u0026repository_url=registry.redhat.io/multicluster-globalhub\u0026tag=1769643304"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:c7cdfe50df5e73358f348f0a9b8f7b35c6a5f4298d4bb6bedae7c7b9da882108_arm64",
                "product": {
                  "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:c7cdfe50df5e73358f348f0a9b8f7b35c6a5f4298d4bb6bedae7c7b9da882108_arm64",
                  "product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:c7cdfe50df5e73358f348f0a9b8f7b35c6a5f4298d4bb6bedae7c7b9da882108_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/multicluster-globalhub-grafana-rhel9@sha256%3Ac7cdfe50df5e73358f348f0a9b8f7b35c6a5f4298d4bb6bedae7c7b9da882108?arch=arm64\u0026repository_url=registry.redhat.io/multicluster-globalhub\u0026tag=1770126537"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:237007606257d24c4dd11ba15b48a4ab4a385d7c6b259f344ac40427d965ccb7_arm64",
                "product": {
                  "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:237007606257d24c4dd11ba15b48a4ab4a385d7c6b259f344ac40427d965ccb7_arm64",
                  "product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:237007606257d24c4dd11ba15b48a4ab4a385d7c6b259f344ac40427d965ccb7_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/multicluster-globalhub-agent-rhel9@sha256%3A237007606257d24c4dd11ba15b48a4ab4a385d7c6b259f344ac40427d965ccb7?arch=arm64\u0026repository_url=registry.redhat.io/multicluster-globalhub\u0026tag=1770281189"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:eed6a559cea86c3790258ab4d43b03618273cd59c4c2c6d484365a6d5c75e458_arm64",
                "product": {
                  "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:eed6a559cea86c3790258ab4d43b03618273cd59c4c2c6d484365a6d5c75e458_arm64",
                  "product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:eed6a559cea86c3790258ab4d43b03618273cd59c4c2c6d484365a6d5c75e458_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/multicluster-globalhub-manager-rhel9@sha256%3Aeed6a559cea86c3790258ab4d43b03618273cd59c4c2c6d484365a6d5c75e458?arch=arm64\u0026repository_url=registry.redhat.io/multicluster-globalhub\u0026tag=1770280963"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:8e05f5585404218773a63e7bbc4c93c18cebec7cd963d45fa28215edffca8448_arm64",
                "product": {
                  "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:8e05f5585404218773a63e7bbc4c93c18cebec7cd963d45fa28215edffca8448_arm64",
                  "product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:8e05f5585404218773a63e7bbc4c93c18cebec7cd963d45fa28215edffca8448_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/multicluster-globalhub-rhel9-operator@sha256%3A8e05f5585404218773a63e7bbc4c93c18cebec7cd963d45fa28215edffca8448?arch=arm64\u0026repository_url=registry.redhat.io/multicluster-globalhub\u0026tag=1770281560"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d6773be40f1cac558fe86a9dd564ba3f2570397c0dbe55e037bf05965987b43c_arm64",
                "product": {
                  "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d6773be40f1cac558fe86a9dd564ba3f2570397c0dbe55e037bf05965987b43c_arm64",
                  "product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d6773be40f1cac558fe86a9dd564ba3f2570397c0dbe55e037bf05965987b43c_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/multicluster-globalhub-postgres-exporter-rhel9@sha256%3Ad6773be40f1cac558fe86a9dd564ba3f2570397c0dbe55e037bf05965987b43c?arch=arm64\u0026repository_url=registry.redhat.io/multicluster-globalhub\u0026tag=1769643304"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "arm64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:237007606257d24c4dd11ba15b48a4ab4a385d7c6b259f344ac40427d965ccb7_arm64 as a component of Red Hat multicluster global hub 1.4.4",
          "product_id": "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:237007606257d24c4dd11ba15b48a4ab4a385d7c6b259f344ac40427d965ccb7_arm64"
        },
        "product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:237007606257d24c4dd11ba15b48a4ab4a385d7c6b259f344ac40427d965ccb7_arm64",
        "relates_to_product_reference": "Red Hat multicluster global hub 1.4.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6bce9f138d78cd05a30d427afbd6fec50211ae3cba1174f796ec618c8862d8c7_s390x as a component of Red Hat multicluster global hub 1.4.4",
          "product_id": "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6bce9f138d78cd05a30d427afbd6fec50211ae3cba1174f796ec618c8862d8c7_s390x"
        },
        "product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6bce9f138d78cd05a30d427afbd6fec50211ae3cba1174f796ec618c8862d8c7_s390x",
        "relates_to_product_reference": "Red Hat multicluster global hub 1.4.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:bca34c5ced99ce0605bb8ff276e99030c480adf8842f038876095669a0d46f7e_amd64 as a component of Red Hat multicluster global hub 1.4.4",
          "product_id": "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:bca34c5ced99ce0605bb8ff276e99030c480adf8842f038876095669a0d46f7e_amd64"
        },
        "product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:bca34c5ced99ce0605bb8ff276e99030c480adf8842f038876095669a0d46f7e_amd64",
        "relates_to_product_reference": "Red Hat multicluster global hub 1.4.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c50c3087b6579a76a07038c59dd685e767ba633428d45a057247054cd5d15e19_ppc64le as a component of Red Hat multicluster global hub 1.4.4",
          "product_id": "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c50c3087b6579a76a07038c59dd685e767ba633428d45a057247054cd5d15e19_ppc64le"
        },
        "product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c50c3087b6579a76a07038c59dd685e767ba633428d45a057247054cd5d15e19_ppc64le",
        "relates_to_product_reference": "Red Hat multicluster global hub 1.4.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:2630957b6783b2bf14940c9a153f25e68b2f4f2cdd17f2ed3a23c284b8d71aca_s390x as a component of Red Hat multicluster global hub 1.4.4",
          "product_id": "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:2630957b6783b2bf14940c9a153f25e68b2f4f2cdd17f2ed3a23c284b8d71aca_s390x"
        },
        "product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:2630957b6783b2bf14940c9a153f25e68b2f4f2cdd17f2ed3a23c284b8d71aca_s390x",
        "relates_to_product_reference": "Red Hat multicluster global hub 1.4.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:29f466fffff1ebdb03c69b57e588d1359324280c82c67788195048aed9e022f5_ppc64le as a component of Red Hat multicluster global hub 1.4.4",
          "product_id": "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:29f466fffff1ebdb03c69b57e588d1359324280c82c67788195048aed9e022f5_ppc64le"
        },
        "product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:29f466fffff1ebdb03c69b57e588d1359324280c82c67788195048aed9e022f5_ppc64le",
        "relates_to_product_reference": "Red Hat multicluster global hub 1.4.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:945a8497173aaba167a71fb4a393714905dd2d00ede0a4eb09c00c4c59727414_amd64 as a component of Red Hat multicluster global hub 1.4.4",
          "product_id": "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:945a8497173aaba167a71fb4a393714905dd2d00ede0a4eb09c00c4c59727414_amd64"
        },
        "product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:945a8497173aaba167a71fb4a393714905dd2d00ede0a4eb09c00c4c59727414_amd64",
        "relates_to_product_reference": "Red Hat multicluster global hub 1.4.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:c7cdfe50df5e73358f348f0a9b8f7b35c6a5f4298d4bb6bedae7c7b9da882108_arm64 as a component of Red Hat multicluster global hub 1.4.4",
          "product_id": "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:c7cdfe50df5e73358f348f0a9b8f7b35c6a5f4298d4bb6bedae7c7b9da882108_arm64"
        },
        "product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:c7cdfe50df5e73358f348f0a9b8f7b35c6a5f4298d4bb6bedae7c7b9da882108_arm64",
        "relates_to_product_reference": "Red Hat multicluster global hub 1.4.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:265f3e651d16fb5416604e7b1dad78d1214f71001f6ac3a33b081d78116f616c_s390x as a component of Red Hat multicluster global hub 1.4.4",
          "product_id": "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:265f3e651d16fb5416604e7b1dad78d1214f71001f6ac3a33b081d78116f616c_s390x"
        },
        "product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:265f3e651d16fb5416604e7b1dad78d1214f71001f6ac3a33b081d78116f616c_s390x",
        "relates_to_product_reference": "Red Hat multicluster global hub 1.4.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:64b490a5a70c31874ba08fbe3ac00f8be2ad74198692432a8ee4762b25e40294_ppc64le as a component of Red Hat multicluster global hub 1.4.4",
          "product_id": "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:64b490a5a70c31874ba08fbe3ac00f8be2ad74198692432a8ee4762b25e40294_ppc64le"
        },
        "product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:64b490a5a70c31874ba08fbe3ac00f8be2ad74198692432a8ee4762b25e40294_ppc64le",
        "relates_to_product_reference": "Red Hat multicluster global hub 1.4.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ca7cc3adb829b0e1526c8dd4494747ed3f0b38dabdc1d9e5b67c967e4db3fb09_amd64 as a component of Red Hat multicluster global hub 1.4.4",
          "product_id": "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ca7cc3adb829b0e1526c8dd4494747ed3f0b38dabdc1d9e5b67c967e4db3fb09_amd64"
        },
        "product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ca7cc3adb829b0e1526c8dd4494747ed3f0b38dabdc1d9e5b67c967e4db3fb09_amd64",
        "relates_to_product_reference": "Red Hat multicluster global hub 1.4.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:eed6a559cea86c3790258ab4d43b03618273cd59c4c2c6d484365a6d5c75e458_arm64 as a component of Red Hat multicluster global hub 1.4.4",
          "product_id": "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:eed6a559cea86c3790258ab4d43b03618273cd59c4c2c6d484365a6d5c75e458_arm64"
        },
        "product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:eed6a559cea86c3790258ab4d43b03618273cd59c4c2c6d484365a6d5c75e458_arm64",
        "relates_to_product_reference": "Red Hat multicluster global hub 1.4.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:f8f73e9cadc8c27f13fd947422aa74908f0cc15eb4a340bc110db757a43c6c6e_amd64 as a component of Red Hat multicluster global hub 1.4.4",
          "product_id": "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:f8f73e9cadc8c27f13fd947422aa74908f0cc15eb4a340bc110db757a43c6c6e_amd64"
        },
        "product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:f8f73e9cadc8c27f13fd947422aa74908f0cc15eb4a340bc110db757a43c6c6e_amd64",
        "relates_to_product_reference": "Red Hat multicluster global hub 1.4.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c24477a58cd87093ac8d47ae89170cc9df4c317f85e86a0a638e2cb62c96644_s390x as a component of Red Hat multicluster global hub 1.4.4",
          "product_id": "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c24477a58cd87093ac8d47ae89170cc9df4c317f85e86a0a638e2cb62c96644_s390x"
        },
        "product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c24477a58cd87093ac8d47ae89170cc9df4c317f85e86a0a638e2cb62c96644_s390x",
        "relates_to_product_reference": "Red Hat multicluster global hub 1.4.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:90aee1f2623f5fb562d1badfbaa9cd993d67642ef3fe6abe523335c6e13df641_ppc64le as a component of Red Hat multicluster global hub 1.4.4",
          "product_id": "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:90aee1f2623f5fb562d1badfbaa9cd993d67642ef3fe6abe523335c6e13df641_ppc64le"
        },
        "product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:90aee1f2623f5fb562d1badfbaa9cd993d67642ef3fe6abe523335c6e13df641_ppc64le",
        "relates_to_product_reference": "Red Hat multicluster global hub 1.4.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c48153736d4573aa3cb6f2428fd10d1c08643cb69bc93d42512f561739243bed_amd64 as a component of Red Hat multicluster global hub 1.4.4",
          "product_id": "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c48153736d4573aa3cb6f2428fd10d1c08643cb69bc93d42512f561739243bed_amd64"
        },
        "product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c48153736d4573aa3cb6f2428fd10d1c08643cb69bc93d42512f561739243bed_amd64",
        "relates_to_product_reference": "Red Hat multicluster global hub 1.4.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d6773be40f1cac558fe86a9dd564ba3f2570397c0dbe55e037bf05965987b43c_arm64 as a component of Red Hat multicluster global hub 1.4.4",
          "product_id": "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d6773be40f1cac558fe86a9dd564ba3f2570397c0dbe55e037bf05965987b43c_arm64"
        },
        "product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d6773be40f1cac558fe86a9dd564ba3f2570397c0dbe55e037bf05965987b43c_arm64",
        "relates_to_product_reference": "Red Hat multicluster global hub 1.4.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5b68ff2c13f4b8670d68ecf73607ea175b168d8eab620c8c666244d3a4d0b209_amd64 as a component of Red Hat multicluster global hub 1.4.4",
          "product_id": "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5b68ff2c13f4b8670d68ecf73607ea175b168d8eab620c8c666244d3a4d0b209_amd64"
        },
        "product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5b68ff2c13f4b8670d68ecf73607ea175b168d8eab620c8c666244d3a4d0b209_amd64",
        "relates_to_product_reference": "Red Hat multicluster global hub 1.4.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:8e05f5585404218773a63e7bbc4c93c18cebec7cd963d45fa28215edffca8448_arm64 as a component of Red Hat multicluster global hub 1.4.4",
          "product_id": "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:8e05f5585404218773a63e7bbc4c93c18cebec7cd963d45fa28215edffca8448_arm64"
        },
        "product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:8e05f5585404218773a63e7bbc4c93c18cebec7cd963d45fa28215edffca8448_arm64",
        "relates_to_product_reference": "Red Hat multicluster global hub 1.4.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:9294e8c4a557d7c03108170a1406ca27e390c77bb71711de54567fa4830f91e7_ppc64le as a component of Red Hat multicluster global hub 1.4.4",
          "product_id": "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:9294e8c4a557d7c03108170a1406ca27e390c77bb71711de54567fa4830f91e7_ppc64le"
        },
        "product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:9294e8c4a557d7c03108170a1406ca27e390c77bb71711de54567fa4830f91e7_ppc64le",
        "relates_to_product_reference": "Red Hat multicluster global hub 1.4.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e8e63947b14543af7407ec3b4639df3f7fe52198b771473670309c00d6ca8733_s390x as a component of Red Hat multicluster global hub 1.4.4",
          "product_id": "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e8e63947b14543af7407ec3b4639df3f7fe52198b771473670309c00d6ca8733_s390x"
        },
        "product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e8e63947b14543af7407ec3b4639df3f7fe52198b771473670309c00d6ca8733_s390x",
        "relates_to_product_reference": "Red Hat multicluster global hub 1.4.4"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-12816",
      "cwe": {
        "id": "CWE-179",
        "name": "Incorrect Behavior Order: Early Validation"
      },
      "discovery_date": "2025-11-25T20:01:05.875196+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:237007606257d24c4dd11ba15b48a4ab4a385d7c6b259f344ac40427d965ccb7_arm64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6bce9f138d78cd05a30d427afbd6fec50211ae3cba1174f796ec618c8862d8c7_s390x",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:bca34c5ced99ce0605bb8ff276e99030c480adf8842f038876095669a0d46f7e_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c50c3087b6579a76a07038c59dd685e767ba633428d45a057247054cd5d15e19_ppc64le",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:265f3e651d16fb5416604e7b1dad78d1214f71001f6ac3a33b081d78116f616c_s390x",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:64b490a5a70c31874ba08fbe3ac00f8be2ad74198692432a8ee4762b25e40294_ppc64le",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ca7cc3adb829b0e1526c8dd4494747ed3f0b38dabdc1d9e5b67c967e4db3fb09_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:eed6a559cea86c3790258ab4d43b03618273cd59c4c2c6d484365a6d5c75e458_arm64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:f8f73e9cadc8c27f13fd947422aa74908f0cc15eb4a340bc110db757a43c6c6e_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c24477a58cd87093ac8d47ae89170cc9df4c317f85e86a0a638e2cb62c96644_s390x",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:90aee1f2623f5fb562d1badfbaa9cd993d67642ef3fe6abe523335c6e13df641_ppc64le",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c48153736d4573aa3cb6f2428fd10d1c08643cb69bc93d42512f561739243bed_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d6773be40f1cac558fe86a9dd564ba3f2570397c0dbe55e037bf05965987b43c_arm64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5b68ff2c13f4b8670d68ecf73607ea175b168d8eab620c8c666244d3a4d0b209_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:8e05f5585404218773a63e7bbc4c93c18cebec7cd963d45fa28215edffca8448_arm64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:9294e8c4a557d7c03108170a1406ca27e390c77bb71711de54567fa4830f91e7_ppc64le",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e8e63947b14543af7407ec3b4639df3f7fe52198b771473670309c00d6ca8733_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2417097"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in node-forge. This vulnerability allows unauthenticated attackers to bypass downstream cryptographic verifications and security decisions via crafting ASN.1 (Abstract Syntax Notation One) structures to desynchronize schema validations, yielding a semantic divergence.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "node-forge: node-forge: Interpretation conflict vulnerability allows bypassing cryptographic verifications",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated Important for Red Hat products due to an interpretation conflict in the node-forge library. An unauthenticated attacker could exploit this flaw by crafting malicious ASN.1 structures, leading to a bypass of cryptographic verifications and security decisions in affected applications. This impacts various Red Hat products that utilize node-forge for cryptographic operations.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:2630957b6783b2bf14940c9a153f25e68b2f4f2cdd17f2ed3a23c284b8d71aca_s390x",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:29f466fffff1ebdb03c69b57e588d1359324280c82c67788195048aed9e022f5_ppc64le",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:945a8497173aaba167a71fb4a393714905dd2d00ede0a4eb09c00c4c59727414_amd64",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:c7cdfe50df5e73358f348f0a9b8f7b35c6a5f4298d4bb6bedae7c7b9da882108_arm64"
        ],
        "known_not_affected": [
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:237007606257d24c4dd11ba15b48a4ab4a385d7c6b259f344ac40427d965ccb7_arm64",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6bce9f138d78cd05a30d427afbd6fec50211ae3cba1174f796ec618c8862d8c7_s390x",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:bca34c5ced99ce0605bb8ff276e99030c480adf8842f038876095669a0d46f7e_amd64",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c50c3087b6579a76a07038c59dd685e767ba633428d45a057247054cd5d15e19_ppc64le",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:265f3e651d16fb5416604e7b1dad78d1214f71001f6ac3a33b081d78116f616c_s390x",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:64b490a5a70c31874ba08fbe3ac00f8be2ad74198692432a8ee4762b25e40294_ppc64le",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ca7cc3adb829b0e1526c8dd4494747ed3f0b38dabdc1d9e5b67c967e4db3fb09_amd64",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:eed6a559cea86c3790258ab4d43b03618273cd59c4c2c6d484365a6d5c75e458_arm64",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:f8f73e9cadc8c27f13fd947422aa74908f0cc15eb4a340bc110db757a43c6c6e_amd64",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c24477a58cd87093ac8d47ae89170cc9df4c317f85e86a0a638e2cb62c96644_s390x",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:90aee1f2623f5fb562d1badfbaa9cd993d67642ef3fe6abe523335c6e13df641_ppc64le",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c48153736d4573aa3cb6f2428fd10d1c08643cb69bc93d42512f561739243bed_amd64",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d6773be40f1cac558fe86a9dd564ba3f2570397c0dbe55e037bf05965987b43c_arm64",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5b68ff2c13f4b8670d68ecf73607ea175b168d8eab620c8c666244d3a4d0b209_amd64",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:8e05f5585404218773a63e7bbc4c93c18cebec7cd963d45fa28215edffca8448_arm64",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:9294e8c4a557d7c03108170a1406ca27e390c77bb71711de54567fa4830f91e7_ppc64le",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e8e63947b14543af7407ec3b4639df3f7fe52198b771473670309c00d6ca8733_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-12816"
        },
        {
          "category": "external",
          "summary": "RHBZ#2417097",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2417097"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-12816",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-12816"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-12816",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12816"
        },
        {
          "category": "external",
          "summary": "https://github.com/digitalbazaar/forge",
          "url": "https://github.com/digitalbazaar/forge"
        },
        {
          "category": "external",
          "summary": "https://github.com/digitalbazaar/forge/pull/1124",
          "url": "https://github.com/digitalbazaar/forge/pull/1124"
        },
        {
          "category": "external",
          "summary": "https://github.com/digitalbazaar/forge/security/advisories/GHSA-5gfm-wpxj-wjgq",
          "url": "https://github.com/digitalbazaar/forge/security/advisories/GHSA-5gfm-wpxj-wjgq"
        },
        {
          "category": "external",
          "summary": "https://kb.cert.org/vuls/id/521113",
          "url": "https://kb.cert.org/vuls/id/521113"
        },
        {
          "category": "external",
          "summary": "https://www.npmjs.com/package/node-forge",
          "url": "https://www.npmjs.com/package/node-forge"
        }
      ],
      "release_date": "2025-11-25T19:15:50.243000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-02-11T05:02:44+00:00",
          "details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.13/html/multicluster_global_hub/index",
          "product_ids": [
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:2630957b6783b2bf14940c9a153f25e68b2f4f2cdd17f2ed3a23c284b8d71aca_s390x",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:29f466fffff1ebdb03c69b57e588d1359324280c82c67788195048aed9e022f5_ppc64le",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:945a8497173aaba167a71fb4a393714905dd2d00ede0a4eb09c00c4c59727414_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:c7cdfe50df5e73358f348f0a9b8f7b35c6a5f4298d4bb6bedae7c7b9da882108_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:2500"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:237007606257d24c4dd11ba15b48a4ab4a385d7c6b259f344ac40427d965ccb7_arm64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6bce9f138d78cd05a30d427afbd6fec50211ae3cba1174f796ec618c8862d8c7_s390x",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:bca34c5ced99ce0605bb8ff276e99030c480adf8842f038876095669a0d46f7e_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c50c3087b6579a76a07038c59dd685e767ba633428d45a057247054cd5d15e19_ppc64le",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:2630957b6783b2bf14940c9a153f25e68b2f4f2cdd17f2ed3a23c284b8d71aca_s390x",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:29f466fffff1ebdb03c69b57e588d1359324280c82c67788195048aed9e022f5_ppc64le",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:945a8497173aaba167a71fb4a393714905dd2d00ede0a4eb09c00c4c59727414_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:c7cdfe50df5e73358f348f0a9b8f7b35c6a5f4298d4bb6bedae7c7b9da882108_arm64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:265f3e651d16fb5416604e7b1dad78d1214f71001f6ac3a33b081d78116f616c_s390x",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:64b490a5a70c31874ba08fbe3ac00f8be2ad74198692432a8ee4762b25e40294_ppc64le",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ca7cc3adb829b0e1526c8dd4494747ed3f0b38dabdc1d9e5b67c967e4db3fb09_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:eed6a559cea86c3790258ab4d43b03618273cd59c4c2c6d484365a6d5c75e458_arm64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:f8f73e9cadc8c27f13fd947422aa74908f0cc15eb4a340bc110db757a43c6c6e_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c24477a58cd87093ac8d47ae89170cc9df4c317f85e86a0a638e2cb62c96644_s390x",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:90aee1f2623f5fb562d1badfbaa9cd993d67642ef3fe6abe523335c6e13df641_ppc64le",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c48153736d4573aa3cb6f2428fd10d1c08643cb69bc93d42512f561739243bed_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d6773be40f1cac558fe86a9dd564ba3f2570397c0dbe55e037bf05965987b43c_arm64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5b68ff2c13f4b8670d68ecf73607ea175b168d8eab620c8c666244d3a4d0b209_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:8e05f5585404218773a63e7bbc4c93c18cebec7cd963d45fa28215edffca8448_arm64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:9294e8c4a557d7c03108170a1406ca27e390c77bb71711de54567fa4830f91e7_ppc64le",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e8e63947b14543af7407ec3b4639df3f7fe52198b771473670309c00d6ca8733_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:237007606257d24c4dd11ba15b48a4ab4a385d7c6b259f344ac40427d965ccb7_arm64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6bce9f138d78cd05a30d427afbd6fec50211ae3cba1174f796ec618c8862d8c7_s390x",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:bca34c5ced99ce0605bb8ff276e99030c480adf8842f038876095669a0d46f7e_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c50c3087b6579a76a07038c59dd685e767ba633428d45a057247054cd5d15e19_ppc64le",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:2630957b6783b2bf14940c9a153f25e68b2f4f2cdd17f2ed3a23c284b8d71aca_s390x",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:29f466fffff1ebdb03c69b57e588d1359324280c82c67788195048aed9e022f5_ppc64le",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:945a8497173aaba167a71fb4a393714905dd2d00ede0a4eb09c00c4c59727414_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:c7cdfe50df5e73358f348f0a9b8f7b35c6a5f4298d4bb6bedae7c7b9da882108_arm64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:265f3e651d16fb5416604e7b1dad78d1214f71001f6ac3a33b081d78116f616c_s390x",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:64b490a5a70c31874ba08fbe3ac00f8be2ad74198692432a8ee4762b25e40294_ppc64le",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ca7cc3adb829b0e1526c8dd4494747ed3f0b38dabdc1d9e5b67c967e4db3fb09_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:eed6a559cea86c3790258ab4d43b03618273cd59c4c2c6d484365a6d5c75e458_arm64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:f8f73e9cadc8c27f13fd947422aa74908f0cc15eb4a340bc110db757a43c6c6e_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c24477a58cd87093ac8d47ae89170cc9df4c317f85e86a0a638e2cb62c96644_s390x",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:90aee1f2623f5fb562d1badfbaa9cd993d67642ef3fe6abe523335c6e13df641_ppc64le",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c48153736d4573aa3cb6f2428fd10d1c08643cb69bc93d42512f561739243bed_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d6773be40f1cac558fe86a9dd564ba3f2570397c0dbe55e037bf05965987b43c_arm64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5b68ff2c13f4b8670d68ecf73607ea175b168d8eab620c8c666244d3a4d0b209_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:8e05f5585404218773a63e7bbc4c93c18cebec7cd963d45fa28215edffca8448_arm64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:9294e8c4a557d7c03108170a1406ca27e390c77bb71711de54567fa4830f91e7_ppc64le",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e8e63947b14543af7407ec3b4639df3f7fe52198b771473670309c00d6ca8733_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "node-forge: node-forge: Interpretation conflict vulnerability allows bypassing cryptographic verifications"
    },
    {
      "cve": "CVE-2025-15284",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2025-12-29T23:00:58.541337+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:237007606257d24c4dd11ba15b48a4ab4a385d7c6b259f344ac40427d965ccb7_arm64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6bce9f138d78cd05a30d427afbd6fec50211ae3cba1174f796ec618c8862d8c7_s390x",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:bca34c5ced99ce0605bb8ff276e99030c480adf8842f038876095669a0d46f7e_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c50c3087b6579a76a07038c59dd685e767ba633428d45a057247054cd5d15e19_ppc64le",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:265f3e651d16fb5416604e7b1dad78d1214f71001f6ac3a33b081d78116f616c_s390x",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:64b490a5a70c31874ba08fbe3ac00f8be2ad74198692432a8ee4762b25e40294_ppc64le",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ca7cc3adb829b0e1526c8dd4494747ed3f0b38dabdc1d9e5b67c967e4db3fb09_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:eed6a559cea86c3790258ab4d43b03618273cd59c4c2c6d484365a6d5c75e458_arm64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:f8f73e9cadc8c27f13fd947422aa74908f0cc15eb4a340bc110db757a43c6c6e_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c24477a58cd87093ac8d47ae89170cc9df4c317f85e86a0a638e2cb62c96644_s390x",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:90aee1f2623f5fb562d1badfbaa9cd993d67642ef3fe6abe523335c6e13df641_ppc64le",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c48153736d4573aa3cb6f2428fd10d1c08643cb69bc93d42512f561739243bed_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d6773be40f1cac558fe86a9dd564ba3f2570397c0dbe55e037bf05965987b43c_arm64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5b68ff2c13f4b8670d68ecf73607ea175b168d8eab620c8c666244d3a4d0b209_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:8e05f5585404218773a63e7bbc4c93c18cebec7cd963d45fa28215edffca8448_arm64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:9294e8c4a557d7c03108170a1406ca27e390c77bb71711de54567fa4830f91e7_ppc64le",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e8e63947b14543af7407ec3b4639df3f7fe52198b771473670309c00d6ca8733_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2425946"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in qs, a module used for parsing query strings. A remote attacker can exploit an improper input validation vulnerability by sending specially crafted HTTP requests that use bracket notation (e.g., `a[]=value`). This bypasses the `arrayLimit` option, which is designed to limit the size of parsed arrays and prevent resource exhaustion. Successful exploitation can lead to memory exhaustion, causing a Denial of Service (DoS) where the application crashes or becomes unresponsive, making the service unavailable to users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "qs: qs: Denial of Service via improper input validation in array parsing",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated Important for Red Hat products that utilize the `qs` module for parsing query strings, particularly when processing user-controlled input with bracket notation. The `arrayLimit` option, intended to prevent resource exhaustion, is bypassed when bracket notation (`a[]=value`) is used, allowing a remote attacker to cause a denial of service through memory exhaustion. This can lead to application crashes or unresponsiveness, making the service unavailable.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:2630957b6783b2bf14940c9a153f25e68b2f4f2cdd17f2ed3a23c284b8d71aca_s390x",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:29f466fffff1ebdb03c69b57e588d1359324280c82c67788195048aed9e022f5_ppc64le",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:945a8497173aaba167a71fb4a393714905dd2d00ede0a4eb09c00c4c59727414_amd64",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:c7cdfe50df5e73358f348f0a9b8f7b35c6a5f4298d4bb6bedae7c7b9da882108_arm64"
        ],
        "known_not_affected": [
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:237007606257d24c4dd11ba15b48a4ab4a385d7c6b259f344ac40427d965ccb7_arm64",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6bce9f138d78cd05a30d427afbd6fec50211ae3cba1174f796ec618c8862d8c7_s390x",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:bca34c5ced99ce0605bb8ff276e99030c480adf8842f038876095669a0d46f7e_amd64",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c50c3087b6579a76a07038c59dd685e767ba633428d45a057247054cd5d15e19_ppc64le",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:265f3e651d16fb5416604e7b1dad78d1214f71001f6ac3a33b081d78116f616c_s390x",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:64b490a5a70c31874ba08fbe3ac00f8be2ad74198692432a8ee4762b25e40294_ppc64le",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ca7cc3adb829b0e1526c8dd4494747ed3f0b38dabdc1d9e5b67c967e4db3fb09_amd64",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:eed6a559cea86c3790258ab4d43b03618273cd59c4c2c6d484365a6d5c75e458_arm64",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:f8f73e9cadc8c27f13fd947422aa74908f0cc15eb4a340bc110db757a43c6c6e_amd64",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c24477a58cd87093ac8d47ae89170cc9df4c317f85e86a0a638e2cb62c96644_s390x",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:90aee1f2623f5fb562d1badfbaa9cd993d67642ef3fe6abe523335c6e13df641_ppc64le",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c48153736d4573aa3cb6f2428fd10d1c08643cb69bc93d42512f561739243bed_amd64",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d6773be40f1cac558fe86a9dd564ba3f2570397c0dbe55e037bf05965987b43c_arm64",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5b68ff2c13f4b8670d68ecf73607ea175b168d8eab620c8c666244d3a4d0b209_amd64",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:8e05f5585404218773a63e7bbc4c93c18cebec7cd963d45fa28215edffca8448_arm64",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:9294e8c4a557d7c03108170a1406ca27e390c77bb71711de54567fa4830f91e7_ppc64le",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e8e63947b14543af7407ec3b4639df3f7fe52198b771473670309c00d6ca8733_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-15284"
        },
        {
          "category": "external",
          "summary": "RHBZ#2425946",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2425946"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-15284",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-15284"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-15284",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15284"
        },
        {
          "category": "external",
          "summary": "https://github.com/ljharb/qs/commit/3086902ecf7f088d0d1803887643ac6c03d415b9",
          "url": "https://github.com/ljharb/qs/commit/3086902ecf7f088d0d1803887643ac6c03d415b9"
        },
        {
          "category": "external",
          "summary": "https://github.com/ljharb/qs/security/advisories/GHSA-6rw7-vpxm-498p",
          "url": "https://github.com/ljharb/qs/security/advisories/GHSA-6rw7-vpxm-498p"
        }
      ],
      "release_date": "2025-12-29T22:56:45.240000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-02-11T05:02:44+00:00",
          "details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.13/html/multicluster_global_hub/index",
          "product_ids": [
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:2630957b6783b2bf14940c9a153f25e68b2f4f2cdd17f2ed3a23c284b8d71aca_s390x",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:29f466fffff1ebdb03c69b57e588d1359324280c82c67788195048aed9e022f5_ppc64le",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:945a8497173aaba167a71fb4a393714905dd2d00ede0a4eb09c00c4c59727414_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:c7cdfe50df5e73358f348f0a9b8f7b35c6a5f4298d4bb6bedae7c7b9da882108_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:2500"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:237007606257d24c4dd11ba15b48a4ab4a385d7c6b259f344ac40427d965ccb7_arm64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6bce9f138d78cd05a30d427afbd6fec50211ae3cba1174f796ec618c8862d8c7_s390x",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:bca34c5ced99ce0605bb8ff276e99030c480adf8842f038876095669a0d46f7e_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c50c3087b6579a76a07038c59dd685e767ba633428d45a057247054cd5d15e19_ppc64le",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:2630957b6783b2bf14940c9a153f25e68b2f4f2cdd17f2ed3a23c284b8d71aca_s390x",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:29f466fffff1ebdb03c69b57e588d1359324280c82c67788195048aed9e022f5_ppc64le",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:945a8497173aaba167a71fb4a393714905dd2d00ede0a4eb09c00c4c59727414_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:c7cdfe50df5e73358f348f0a9b8f7b35c6a5f4298d4bb6bedae7c7b9da882108_arm64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:265f3e651d16fb5416604e7b1dad78d1214f71001f6ac3a33b081d78116f616c_s390x",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:64b490a5a70c31874ba08fbe3ac00f8be2ad74198692432a8ee4762b25e40294_ppc64le",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ca7cc3adb829b0e1526c8dd4494747ed3f0b38dabdc1d9e5b67c967e4db3fb09_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:eed6a559cea86c3790258ab4d43b03618273cd59c4c2c6d484365a6d5c75e458_arm64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:f8f73e9cadc8c27f13fd947422aa74908f0cc15eb4a340bc110db757a43c6c6e_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c24477a58cd87093ac8d47ae89170cc9df4c317f85e86a0a638e2cb62c96644_s390x",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:90aee1f2623f5fb562d1badfbaa9cd993d67642ef3fe6abe523335c6e13df641_ppc64le",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c48153736d4573aa3cb6f2428fd10d1c08643cb69bc93d42512f561739243bed_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d6773be40f1cac558fe86a9dd564ba3f2570397c0dbe55e037bf05965987b43c_arm64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5b68ff2c13f4b8670d68ecf73607ea175b168d8eab620c8c666244d3a4d0b209_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:8e05f5585404218773a63e7bbc4c93c18cebec7cd963d45fa28215edffca8448_arm64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:9294e8c4a557d7c03108170a1406ca27e390c77bb71711de54567fa4830f91e7_ppc64le",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e8e63947b14543af7407ec3b4639df3f7fe52198b771473670309c00d6ca8733_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:237007606257d24c4dd11ba15b48a4ab4a385d7c6b259f344ac40427d965ccb7_arm64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6bce9f138d78cd05a30d427afbd6fec50211ae3cba1174f796ec618c8862d8c7_s390x",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:bca34c5ced99ce0605bb8ff276e99030c480adf8842f038876095669a0d46f7e_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c50c3087b6579a76a07038c59dd685e767ba633428d45a057247054cd5d15e19_ppc64le",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:2630957b6783b2bf14940c9a153f25e68b2f4f2cdd17f2ed3a23c284b8d71aca_s390x",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:29f466fffff1ebdb03c69b57e588d1359324280c82c67788195048aed9e022f5_ppc64le",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:945a8497173aaba167a71fb4a393714905dd2d00ede0a4eb09c00c4c59727414_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:c7cdfe50df5e73358f348f0a9b8f7b35c6a5f4298d4bb6bedae7c7b9da882108_arm64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:265f3e651d16fb5416604e7b1dad78d1214f71001f6ac3a33b081d78116f616c_s390x",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:64b490a5a70c31874ba08fbe3ac00f8be2ad74198692432a8ee4762b25e40294_ppc64le",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ca7cc3adb829b0e1526c8dd4494747ed3f0b38dabdc1d9e5b67c967e4db3fb09_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:eed6a559cea86c3790258ab4d43b03618273cd59c4c2c6d484365a6d5c75e458_arm64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:f8f73e9cadc8c27f13fd947422aa74908f0cc15eb4a340bc110db757a43c6c6e_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c24477a58cd87093ac8d47ae89170cc9df4c317f85e86a0a638e2cb62c96644_s390x",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:90aee1f2623f5fb562d1badfbaa9cd993d67642ef3fe6abe523335c6e13df641_ppc64le",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c48153736d4573aa3cb6f2428fd10d1c08643cb69bc93d42512f561739243bed_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d6773be40f1cac558fe86a9dd564ba3f2570397c0dbe55e037bf05965987b43c_arm64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5b68ff2c13f4b8670d68ecf73607ea175b168d8eab620c8c666244d3a4d0b209_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:8e05f5585404218773a63e7bbc4c93c18cebec7cd963d45fa28215edffca8448_arm64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:9294e8c4a557d7c03108170a1406ca27e390c77bb71711de54567fa4830f91e7_ppc64le",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e8e63947b14543af7407ec3b4639df3f7fe52198b771473670309c00d6ca8733_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "qs: qs: Denial of Service via improper input validation in array parsing"
    },
    {
      "cve": "CVE-2025-66418",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2025-12-05T17:01:20.277857+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:237007606257d24c4dd11ba15b48a4ab4a385d7c6b259f344ac40427d965ccb7_arm64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6bce9f138d78cd05a30d427afbd6fec50211ae3cba1174f796ec618c8862d8c7_s390x",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:bca34c5ced99ce0605bb8ff276e99030c480adf8842f038876095669a0d46f7e_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c50c3087b6579a76a07038c59dd685e767ba633428d45a057247054cd5d15e19_ppc64le",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:265f3e651d16fb5416604e7b1dad78d1214f71001f6ac3a33b081d78116f616c_s390x",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:64b490a5a70c31874ba08fbe3ac00f8be2ad74198692432a8ee4762b25e40294_ppc64le",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ca7cc3adb829b0e1526c8dd4494747ed3f0b38dabdc1d9e5b67c967e4db3fb09_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:eed6a559cea86c3790258ab4d43b03618273cd59c4c2c6d484365a6d5c75e458_arm64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:f8f73e9cadc8c27f13fd947422aa74908f0cc15eb4a340bc110db757a43c6c6e_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c24477a58cd87093ac8d47ae89170cc9df4c317f85e86a0a638e2cb62c96644_s390x",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:90aee1f2623f5fb562d1badfbaa9cd993d67642ef3fe6abe523335c6e13df641_ppc64le",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c48153736d4573aa3cb6f2428fd10d1c08643cb69bc93d42512f561739243bed_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d6773be40f1cac558fe86a9dd564ba3f2570397c0dbe55e037bf05965987b43c_arm64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5b68ff2c13f4b8670d68ecf73607ea175b168d8eab620c8c666244d3a4d0b209_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:8e05f5585404218773a63e7bbc4c93c18cebec7cd963d45fa28215edffca8448_arm64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:9294e8c4a557d7c03108170a1406ca27e390c77bb71711de54567fa4830f91e7_ppc64le",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e8e63947b14543af7407ec3b4639df3f7fe52198b771473670309c00d6ca8733_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2419455"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data. This vulnerability is fixed in 2.6.0.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:2630957b6783b2bf14940c9a153f25e68b2f4f2cdd17f2ed3a23c284b8d71aca_s390x",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:29f466fffff1ebdb03c69b57e588d1359324280c82c67788195048aed9e022f5_ppc64le",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:945a8497173aaba167a71fb4a393714905dd2d00ede0a4eb09c00c4c59727414_amd64",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:c7cdfe50df5e73358f348f0a9b8f7b35c6a5f4298d4bb6bedae7c7b9da882108_arm64"
        ],
        "known_not_affected": [
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:237007606257d24c4dd11ba15b48a4ab4a385d7c6b259f344ac40427d965ccb7_arm64",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6bce9f138d78cd05a30d427afbd6fec50211ae3cba1174f796ec618c8862d8c7_s390x",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:bca34c5ced99ce0605bb8ff276e99030c480adf8842f038876095669a0d46f7e_amd64",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c50c3087b6579a76a07038c59dd685e767ba633428d45a057247054cd5d15e19_ppc64le",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:265f3e651d16fb5416604e7b1dad78d1214f71001f6ac3a33b081d78116f616c_s390x",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:64b490a5a70c31874ba08fbe3ac00f8be2ad74198692432a8ee4762b25e40294_ppc64le",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ca7cc3adb829b0e1526c8dd4494747ed3f0b38dabdc1d9e5b67c967e4db3fb09_amd64",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:eed6a559cea86c3790258ab4d43b03618273cd59c4c2c6d484365a6d5c75e458_arm64",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:f8f73e9cadc8c27f13fd947422aa74908f0cc15eb4a340bc110db757a43c6c6e_amd64",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c24477a58cd87093ac8d47ae89170cc9df4c317f85e86a0a638e2cb62c96644_s390x",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:90aee1f2623f5fb562d1badfbaa9cd993d67642ef3fe6abe523335c6e13df641_ppc64le",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c48153736d4573aa3cb6f2428fd10d1c08643cb69bc93d42512f561739243bed_amd64",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d6773be40f1cac558fe86a9dd564ba3f2570397c0dbe55e037bf05965987b43c_arm64",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5b68ff2c13f4b8670d68ecf73607ea175b168d8eab620c8c666244d3a4d0b209_amd64",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:8e05f5585404218773a63e7bbc4c93c18cebec7cd963d45fa28215edffca8448_arm64",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:9294e8c4a557d7c03108170a1406ca27e390c77bb71711de54567fa4830f91e7_ppc64le",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e8e63947b14543af7407ec3b4639df3f7fe52198b771473670309c00d6ca8733_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-66418"
        },
        {
          "category": "external",
          "summary": "RHBZ#2419455",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2419455"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-66418",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-66418"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-66418",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66418"
        },
        {
          "category": "external",
          "summary": "https://github.com/urllib3/urllib3/commit/24d7b67eac89f94e11003424bcf0d8f7b72222a8",
          "url": "https://github.com/urllib3/urllib3/commit/24d7b67eac89f94e11003424bcf0d8f7b72222a8"
        },
        {
          "category": "external",
          "summary": "https://github.com/urllib3/urllib3/security/advisories/GHSA-gm62-xv2j-4w53",
          "url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-gm62-xv2j-4w53"
        }
      ],
      "release_date": "2025-12-05T16:02:15.271000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-02-11T05:02:44+00:00",
          "details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.13/html/multicluster_global_hub/index",
          "product_ids": [
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:2630957b6783b2bf14940c9a153f25e68b2f4f2cdd17f2ed3a23c284b8d71aca_s390x",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:29f466fffff1ebdb03c69b57e588d1359324280c82c67788195048aed9e022f5_ppc64le",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:945a8497173aaba167a71fb4a393714905dd2d00ede0a4eb09c00c4c59727414_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:c7cdfe50df5e73358f348f0a9b8f7b35c6a5f4298d4bb6bedae7c7b9da882108_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:2500"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:237007606257d24c4dd11ba15b48a4ab4a385d7c6b259f344ac40427d965ccb7_arm64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6bce9f138d78cd05a30d427afbd6fec50211ae3cba1174f796ec618c8862d8c7_s390x",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:bca34c5ced99ce0605bb8ff276e99030c480adf8842f038876095669a0d46f7e_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c50c3087b6579a76a07038c59dd685e767ba633428d45a057247054cd5d15e19_ppc64le",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:2630957b6783b2bf14940c9a153f25e68b2f4f2cdd17f2ed3a23c284b8d71aca_s390x",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:29f466fffff1ebdb03c69b57e588d1359324280c82c67788195048aed9e022f5_ppc64le",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:945a8497173aaba167a71fb4a393714905dd2d00ede0a4eb09c00c4c59727414_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:c7cdfe50df5e73358f348f0a9b8f7b35c6a5f4298d4bb6bedae7c7b9da882108_arm64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:265f3e651d16fb5416604e7b1dad78d1214f71001f6ac3a33b081d78116f616c_s390x",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:64b490a5a70c31874ba08fbe3ac00f8be2ad74198692432a8ee4762b25e40294_ppc64le",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ca7cc3adb829b0e1526c8dd4494747ed3f0b38dabdc1d9e5b67c967e4db3fb09_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:eed6a559cea86c3790258ab4d43b03618273cd59c4c2c6d484365a6d5c75e458_arm64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:f8f73e9cadc8c27f13fd947422aa74908f0cc15eb4a340bc110db757a43c6c6e_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c24477a58cd87093ac8d47ae89170cc9df4c317f85e86a0a638e2cb62c96644_s390x",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:90aee1f2623f5fb562d1badfbaa9cd993d67642ef3fe6abe523335c6e13df641_ppc64le",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c48153736d4573aa3cb6f2428fd10d1c08643cb69bc93d42512f561739243bed_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d6773be40f1cac558fe86a9dd564ba3f2570397c0dbe55e037bf05965987b43c_arm64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5b68ff2c13f4b8670d68ecf73607ea175b168d8eab620c8c666244d3a4d0b209_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:8e05f5585404218773a63e7bbc4c93c18cebec7cd963d45fa28215edffca8448_arm64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:9294e8c4a557d7c03108170a1406ca27e390c77bb71711de54567fa4830f91e7_ppc64le",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e8e63947b14543af7407ec3b4639df3f7fe52198b771473670309c00d6ca8733_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion"
    },
    {
      "cve": "CVE-2025-66471",
      "cwe": {
        "id": "CWE-409",
        "name": "Improper Handling of Highly Compressed Data (Data Amplification)"
      },
      "discovery_date": "2025-12-05T17:02:21.597728+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:237007606257d24c4dd11ba15b48a4ab4a385d7c6b259f344ac40427d965ccb7_arm64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6bce9f138d78cd05a30d427afbd6fec50211ae3cba1174f796ec618c8862d8c7_s390x",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:bca34c5ced99ce0605bb8ff276e99030c480adf8842f038876095669a0d46f7e_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c50c3087b6579a76a07038c59dd685e767ba633428d45a057247054cd5d15e19_ppc64le",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:265f3e651d16fb5416604e7b1dad78d1214f71001f6ac3a33b081d78116f616c_s390x",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:64b490a5a70c31874ba08fbe3ac00f8be2ad74198692432a8ee4762b25e40294_ppc64le",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ca7cc3adb829b0e1526c8dd4494747ed3f0b38dabdc1d9e5b67c967e4db3fb09_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:eed6a559cea86c3790258ab4d43b03618273cd59c4c2c6d484365a6d5c75e458_arm64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:f8f73e9cadc8c27f13fd947422aa74908f0cc15eb4a340bc110db757a43c6c6e_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c24477a58cd87093ac8d47ae89170cc9df4c317f85e86a0a638e2cb62c96644_s390x",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:90aee1f2623f5fb562d1badfbaa9cd993d67642ef3fe6abe523335c6e13df641_ppc64le",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c48153736d4573aa3cb6f2428fd10d1c08643cb69bc93d42512f561739243bed_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d6773be40f1cac558fe86a9dd564ba3f2570397c0dbe55e037bf05965987b43c_arm64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5b68ff2c13f4b8670d68ecf73607ea175b168d8eab620c8c666244d3a4d0b209_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:8e05f5585404218773a63e7bbc4c93c18cebec7cd963d45fa28215edffca8448_arm64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:9294e8c4a557d7c03108170a1406ca27e390c77bb71711de54567fa4830f91e7_ppc64le",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e8e63947b14543af7407ec3b4639df3f7fe52198b771473670309c00d6ca8733_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2419467"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly compressed data. urllib3\u0027s streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. When streaming a compressed response, urllib3 can perform decoding or decompression based on the HTTP Content-Encoding header (e.g., gzip, deflate, br, or zstd). The library must read compressed data from the network and decompress it until the requested chunk size is met. Any resulting decompressed data that exceeds the requested amount is held in an internal buffer for the next read operation. The decompression logic could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This can result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "urllib3: urllib3 Streaming API improperly handles highly compressed data",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:2630957b6783b2bf14940c9a153f25e68b2f4f2cdd17f2ed3a23c284b8d71aca_s390x",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:29f466fffff1ebdb03c69b57e588d1359324280c82c67788195048aed9e022f5_ppc64le",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:945a8497173aaba167a71fb4a393714905dd2d00ede0a4eb09c00c4c59727414_amd64",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:c7cdfe50df5e73358f348f0a9b8f7b35c6a5f4298d4bb6bedae7c7b9da882108_arm64"
        ],
        "known_not_affected": [
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:237007606257d24c4dd11ba15b48a4ab4a385d7c6b259f344ac40427d965ccb7_arm64",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6bce9f138d78cd05a30d427afbd6fec50211ae3cba1174f796ec618c8862d8c7_s390x",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:bca34c5ced99ce0605bb8ff276e99030c480adf8842f038876095669a0d46f7e_amd64",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c50c3087b6579a76a07038c59dd685e767ba633428d45a057247054cd5d15e19_ppc64le",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:265f3e651d16fb5416604e7b1dad78d1214f71001f6ac3a33b081d78116f616c_s390x",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:64b490a5a70c31874ba08fbe3ac00f8be2ad74198692432a8ee4762b25e40294_ppc64le",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ca7cc3adb829b0e1526c8dd4494747ed3f0b38dabdc1d9e5b67c967e4db3fb09_amd64",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:eed6a559cea86c3790258ab4d43b03618273cd59c4c2c6d484365a6d5c75e458_arm64",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:f8f73e9cadc8c27f13fd947422aa74908f0cc15eb4a340bc110db757a43c6c6e_amd64",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c24477a58cd87093ac8d47ae89170cc9df4c317f85e86a0a638e2cb62c96644_s390x",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:90aee1f2623f5fb562d1badfbaa9cd993d67642ef3fe6abe523335c6e13df641_ppc64le",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c48153736d4573aa3cb6f2428fd10d1c08643cb69bc93d42512f561739243bed_amd64",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d6773be40f1cac558fe86a9dd564ba3f2570397c0dbe55e037bf05965987b43c_arm64",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5b68ff2c13f4b8670d68ecf73607ea175b168d8eab620c8c666244d3a4d0b209_amd64",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:8e05f5585404218773a63e7bbc4c93c18cebec7cd963d45fa28215edffca8448_arm64",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:9294e8c4a557d7c03108170a1406ca27e390c77bb71711de54567fa4830f91e7_ppc64le",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e8e63947b14543af7407ec3b4639df3f7fe52198b771473670309c00d6ca8733_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-66471"
        },
        {
          "category": "external",
          "summary": "RHBZ#2419467",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2419467"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-66471",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-66471"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-66471",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66471"
        },
        {
          "category": "external",
          "summary": "https://github.com/urllib3/urllib3/commit/c19571de34c47de3a766541b041637ba5f716ed7",
          "url": "https://github.com/urllib3/urllib3/commit/c19571de34c47de3a766541b041637ba5f716ed7"
        },
        {
          "category": "external",
          "summary": "https://github.com/urllib3/urllib3/security/advisories/GHSA-2xpw-w6gg-jr37",
          "url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-2xpw-w6gg-jr37"
        }
      ],
      "release_date": "2025-12-05T16:06:08.531000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-02-11T05:02:44+00:00",
          "details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.13/html/multicluster_global_hub/index",
          "product_ids": [
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:2630957b6783b2bf14940c9a153f25e68b2f4f2cdd17f2ed3a23c284b8d71aca_s390x",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:29f466fffff1ebdb03c69b57e588d1359324280c82c67788195048aed9e022f5_ppc64le",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:945a8497173aaba167a71fb4a393714905dd2d00ede0a4eb09c00c4c59727414_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:c7cdfe50df5e73358f348f0a9b8f7b35c6a5f4298d4bb6bedae7c7b9da882108_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:2500"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:237007606257d24c4dd11ba15b48a4ab4a385d7c6b259f344ac40427d965ccb7_arm64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6bce9f138d78cd05a30d427afbd6fec50211ae3cba1174f796ec618c8862d8c7_s390x",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:bca34c5ced99ce0605bb8ff276e99030c480adf8842f038876095669a0d46f7e_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c50c3087b6579a76a07038c59dd685e767ba633428d45a057247054cd5d15e19_ppc64le",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:2630957b6783b2bf14940c9a153f25e68b2f4f2cdd17f2ed3a23c284b8d71aca_s390x",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:29f466fffff1ebdb03c69b57e588d1359324280c82c67788195048aed9e022f5_ppc64le",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:945a8497173aaba167a71fb4a393714905dd2d00ede0a4eb09c00c4c59727414_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:c7cdfe50df5e73358f348f0a9b8f7b35c6a5f4298d4bb6bedae7c7b9da882108_arm64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:265f3e651d16fb5416604e7b1dad78d1214f71001f6ac3a33b081d78116f616c_s390x",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:64b490a5a70c31874ba08fbe3ac00f8be2ad74198692432a8ee4762b25e40294_ppc64le",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ca7cc3adb829b0e1526c8dd4494747ed3f0b38dabdc1d9e5b67c967e4db3fb09_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:eed6a559cea86c3790258ab4d43b03618273cd59c4c2c6d484365a6d5c75e458_arm64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:f8f73e9cadc8c27f13fd947422aa74908f0cc15eb4a340bc110db757a43c6c6e_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c24477a58cd87093ac8d47ae89170cc9df4c317f85e86a0a638e2cb62c96644_s390x",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:90aee1f2623f5fb562d1badfbaa9cd993d67642ef3fe6abe523335c6e13df641_ppc64le",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c48153736d4573aa3cb6f2428fd10d1c08643cb69bc93d42512f561739243bed_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d6773be40f1cac558fe86a9dd564ba3f2570397c0dbe55e037bf05965987b43c_arm64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5b68ff2c13f4b8670d68ecf73607ea175b168d8eab620c8c666244d3a4d0b209_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:8e05f5585404218773a63e7bbc4c93c18cebec7cd963d45fa28215edffca8448_arm64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:9294e8c4a557d7c03108170a1406ca27e390c77bb71711de54567fa4830f91e7_ppc64le",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e8e63947b14543af7407ec3b4639df3f7fe52198b771473670309c00d6ca8733_s390x"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:237007606257d24c4dd11ba15b48a4ab4a385d7c6b259f344ac40427d965ccb7_arm64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6bce9f138d78cd05a30d427afbd6fec50211ae3cba1174f796ec618c8862d8c7_s390x",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:bca34c5ced99ce0605bb8ff276e99030c480adf8842f038876095669a0d46f7e_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c50c3087b6579a76a07038c59dd685e767ba633428d45a057247054cd5d15e19_ppc64le",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:2630957b6783b2bf14940c9a153f25e68b2f4f2cdd17f2ed3a23c284b8d71aca_s390x",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:29f466fffff1ebdb03c69b57e588d1359324280c82c67788195048aed9e022f5_ppc64le",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:945a8497173aaba167a71fb4a393714905dd2d00ede0a4eb09c00c4c59727414_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:c7cdfe50df5e73358f348f0a9b8f7b35c6a5f4298d4bb6bedae7c7b9da882108_arm64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:265f3e651d16fb5416604e7b1dad78d1214f71001f6ac3a33b081d78116f616c_s390x",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:64b490a5a70c31874ba08fbe3ac00f8be2ad74198692432a8ee4762b25e40294_ppc64le",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ca7cc3adb829b0e1526c8dd4494747ed3f0b38dabdc1d9e5b67c967e4db3fb09_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:eed6a559cea86c3790258ab4d43b03618273cd59c4c2c6d484365a6d5c75e458_arm64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:f8f73e9cadc8c27f13fd947422aa74908f0cc15eb4a340bc110db757a43c6c6e_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c24477a58cd87093ac8d47ae89170cc9df4c317f85e86a0a638e2cb62c96644_s390x",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:90aee1f2623f5fb562d1badfbaa9cd993d67642ef3fe6abe523335c6e13df641_ppc64le",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c48153736d4573aa3cb6f2428fd10d1c08643cb69bc93d42512f561739243bed_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d6773be40f1cac558fe86a9dd564ba3f2570397c0dbe55e037bf05965987b43c_arm64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5b68ff2c13f4b8670d68ecf73607ea175b168d8eab620c8c666244d3a4d0b209_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:8e05f5585404218773a63e7bbc4c93c18cebec7cd963d45fa28215edffca8448_arm64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:9294e8c4a557d7c03108170a1406ca27e390c77bb71711de54567fa4830f91e7_ppc64le",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e8e63947b14543af7407ec3b4639df3f7fe52198b771473670309c00d6ca8733_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "urllib3: urllib3 Streaming API improperly handles highly compressed data"
    },
    {
      "cve": "CVE-2025-68429",
      "cwe": {
        "id": "CWE-538",
        "name": "Insertion of Sensitive Information into Externally-Accessible File or Directory"
      },
      "discovery_date": "2025-12-17T23:03:29.948214+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:237007606257d24c4dd11ba15b48a4ab4a385d7c6b259f344ac40427d965ccb7_arm64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6bce9f138d78cd05a30d427afbd6fec50211ae3cba1174f796ec618c8862d8c7_s390x",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:bca34c5ced99ce0605bb8ff276e99030c480adf8842f038876095669a0d46f7e_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c50c3087b6579a76a07038c59dd685e767ba633428d45a057247054cd5d15e19_ppc64le",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:265f3e651d16fb5416604e7b1dad78d1214f71001f6ac3a33b081d78116f616c_s390x",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:64b490a5a70c31874ba08fbe3ac00f8be2ad74198692432a8ee4762b25e40294_ppc64le",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ca7cc3adb829b0e1526c8dd4494747ed3f0b38dabdc1d9e5b67c967e4db3fb09_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:eed6a559cea86c3790258ab4d43b03618273cd59c4c2c6d484365a6d5c75e458_arm64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:f8f73e9cadc8c27f13fd947422aa74908f0cc15eb4a340bc110db757a43c6c6e_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c24477a58cd87093ac8d47ae89170cc9df4c317f85e86a0a638e2cb62c96644_s390x",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:90aee1f2623f5fb562d1badfbaa9cd993d67642ef3fe6abe523335c6e13df641_ppc64le",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c48153736d4573aa3cb6f2428fd10d1c08643cb69bc93d42512f561739243bed_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d6773be40f1cac558fe86a9dd564ba3f2570397c0dbe55e037bf05965987b43c_arm64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5b68ff2c13f4b8670d68ecf73607ea175b168d8eab620c8c666244d3a4d0b209_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:8e05f5585404218773a63e7bbc4c93c18cebec7cd963d45fa28215edffca8448_arm64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:9294e8c4a557d7c03108170a1406ca27e390c77bb71711de54567fa4830f91e7_ppc64le",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e8e63947b14543af7407ec3b4639df3f7fe52198b771473670309c00d6ca8733_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2423460"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Storybook is a frontend workshop for building user interface components and pages in isolation. A vulnerability present starting in versions 7.0.0 and prior to versions 7.6.21, 8.6.15, 9.1.17, and 10.1.10 relates to Storybook\u2019s handling of environment variables defined in a `.env` file, which could, in specific circumstances, lead to those variables being unexpectedly bundled into the artifacts created by the `storybook build` command. When a built Storybook is published to the web, the bundle\u2019s source is viewable, thus potentially exposing those variables to anyone with access. For a project to potentially be vulnerable to this issue, it must build the Storybook (i.e. run `storybook build` directly or indirectly) in a directory that contains a `.env` file (including variants like `.env.local`) and publish the built Storybook to the web. Storybooks built without a `.env` file at build time are not affected, including common CI-based builds where secrets are provided via platform environment variables rather than `.env` files. Storybook runtime environments (i.e. `storybook dev`) are not affected. Deployed applications that share a repo with your Storybook are not affected. Users should upgrade their Storybook\u2014on both their local machines and CI environment\u2014to version .6.21, 8.6.15, 9.1.17, or 10.1.10 as soon as possible. Maintainers additionally recommend that users audit for any sensitive secrets provided via `.env` files and rotate those keys. Some projects may have been relying on the undocumented behavior at the heart of this issue and will need to change how they reference environment variables after this update. If a project can no longer read necessary environmental variable values, either prefix the variables with `STORYBOOK_` or use the `env` property in Storybook\u2019s configuration to manually specify values. In either case, do not include sensitive secrets as they will be included in the built bundle.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Storybook: Storybook: Information disclosure via unexpected bundling of environment variables",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated Important for Red Hat as it can lead to the unintended exposure of sensitive environment variables. This occurs when a Storybook project is built using the `storybook build` command in a directory containing a `.env` file, and the resulting bundle is subsequently published to a web-accessible location. Storybook instances built without `.env` files or run in development mode (`storybook dev`) are not affected.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:2630957b6783b2bf14940c9a153f25e68b2f4f2cdd17f2ed3a23c284b8d71aca_s390x",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:29f466fffff1ebdb03c69b57e588d1359324280c82c67788195048aed9e022f5_ppc64le",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:945a8497173aaba167a71fb4a393714905dd2d00ede0a4eb09c00c4c59727414_amd64",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:c7cdfe50df5e73358f348f0a9b8f7b35c6a5f4298d4bb6bedae7c7b9da882108_arm64"
        ],
        "known_not_affected": [
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:237007606257d24c4dd11ba15b48a4ab4a385d7c6b259f344ac40427d965ccb7_arm64",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6bce9f138d78cd05a30d427afbd6fec50211ae3cba1174f796ec618c8862d8c7_s390x",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:bca34c5ced99ce0605bb8ff276e99030c480adf8842f038876095669a0d46f7e_amd64",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c50c3087b6579a76a07038c59dd685e767ba633428d45a057247054cd5d15e19_ppc64le",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:265f3e651d16fb5416604e7b1dad78d1214f71001f6ac3a33b081d78116f616c_s390x",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:64b490a5a70c31874ba08fbe3ac00f8be2ad74198692432a8ee4762b25e40294_ppc64le",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ca7cc3adb829b0e1526c8dd4494747ed3f0b38dabdc1d9e5b67c967e4db3fb09_amd64",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:eed6a559cea86c3790258ab4d43b03618273cd59c4c2c6d484365a6d5c75e458_arm64",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:f8f73e9cadc8c27f13fd947422aa74908f0cc15eb4a340bc110db757a43c6c6e_amd64",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c24477a58cd87093ac8d47ae89170cc9df4c317f85e86a0a638e2cb62c96644_s390x",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:90aee1f2623f5fb562d1badfbaa9cd993d67642ef3fe6abe523335c6e13df641_ppc64le",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c48153736d4573aa3cb6f2428fd10d1c08643cb69bc93d42512f561739243bed_amd64",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d6773be40f1cac558fe86a9dd564ba3f2570397c0dbe55e037bf05965987b43c_arm64",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5b68ff2c13f4b8670d68ecf73607ea175b168d8eab620c8c666244d3a4d0b209_amd64",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:8e05f5585404218773a63e7bbc4c93c18cebec7cd963d45fa28215edffca8448_arm64",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:9294e8c4a557d7c03108170a1406ca27e390c77bb71711de54567fa4830f91e7_ppc64le",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e8e63947b14543af7407ec3b4639df3f7fe52198b771473670309c00d6ca8733_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-68429"
        },
        {
          "category": "external",
          "summary": "RHBZ#2423460",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2423460"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-68429",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-68429"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-68429",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68429"
        },
        {
          "category": "external",
          "summary": "https://github.com/storybookjs/storybook/security/advisories/GHSA-8452-54wp-rmv6",
          "url": "https://github.com/storybookjs/storybook/security/advisories/GHSA-8452-54wp-rmv6"
        },
        {
          "category": "external",
          "summary": "https://storybook.js.org/blog/security-advisory",
          "url": "https://storybook.js.org/blog/security-advisory"
        }
      ],
      "release_date": "2025-12-17T22:26:55.732000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-02-11T05:02:44+00:00",
          "details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.13/html/multicluster_global_hub/index",
          "product_ids": [
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:2630957b6783b2bf14940c9a153f25e68b2f4f2cdd17f2ed3a23c284b8d71aca_s390x",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:29f466fffff1ebdb03c69b57e588d1359324280c82c67788195048aed9e022f5_ppc64le",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:945a8497173aaba167a71fb4a393714905dd2d00ede0a4eb09c00c4c59727414_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:c7cdfe50df5e73358f348f0a9b8f7b35c6a5f4298d4bb6bedae7c7b9da882108_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:2500"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:237007606257d24c4dd11ba15b48a4ab4a385d7c6b259f344ac40427d965ccb7_arm64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6bce9f138d78cd05a30d427afbd6fec50211ae3cba1174f796ec618c8862d8c7_s390x",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:bca34c5ced99ce0605bb8ff276e99030c480adf8842f038876095669a0d46f7e_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c50c3087b6579a76a07038c59dd685e767ba633428d45a057247054cd5d15e19_ppc64le",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:2630957b6783b2bf14940c9a153f25e68b2f4f2cdd17f2ed3a23c284b8d71aca_s390x",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:29f466fffff1ebdb03c69b57e588d1359324280c82c67788195048aed9e022f5_ppc64le",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:945a8497173aaba167a71fb4a393714905dd2d00ede0a4eb09c00c4c59727414_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:c7cdfe50df5e73358f348f0a9b8f7b35c6a5f4298d4bb6bedae7c7b9da882108_arm64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:265f3e651d16fb5416604e7b1dad78d1214f71001f6ac3a33b081d78116f616c_s390x",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:64b490a5a70c31874ba08fbe3ac00f8be2ad74198692432a8ee4762b25e40294_ppc64le",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ca7cc3adb829b0e1526c8dd4494747ed3f0b38dabdc1d9e5b67c967e4db3fb09_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:eed6a559cea86c3790258ab4d43b03618273cd59c4c2c6d484365a6d5c75e458_arm64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:f8f73e9cadc8c27f13fd947422aa74908f0cc15eb4a340bc110db757a43c6c6e_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c24477a58cd87093ac8d47ae89170cc9df4c317f85e86a0a638e2cb62c96644_s390x",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:90aee1f2623f5fb562d1badfbaa9cd993d67642ef3fe6abe523335c6e13df641_ppc64le",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c48153736d4573aa3cb6f2428fd10d1c08643cb69bc93d42512f561739243bed_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d6773be40f1cac558fe86a9dd564ba3f2570397c0dbe55e037bf05965987b43c_arm64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5b68ff2c13f4b8670d68ecf73607ea175b168d8eab620c8c666244d3a4d0b209_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:8e05f5585404218773a63e7bbc4c93c18cebec7cd963d45fa28215edffca8448_arm64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:9294e8c4a557d7c03108170a1406ca27e390c77bb71711de54567fa4830f91e7_ppc64le",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e8e63947b14543af7407ec3b4639df3f7fe52198b771473670309c00d6ca8733_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "Storybook: Storybook: Information disclosure via unexpected bundling of environment variables"
    },
    {
      "cve": "CVE-2026-21441",
      "cwe": {
        "id": "CWE-409",
        "name": "Improper Handling of Highly Compressed Data (Data Amplification)"
      },
      "discovery_date": "2026-01-07T23:01:59.422078+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:237007606257d24c4dd11ba15b48a4ab4a385d7c6b259f344ac40427d965ccb7_arm64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6bce9f138d78cd05a30d427afbd6fec50211ae3cba1174f796ec618c8862d8c7_s390x",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:bca34c5ced99ce0605bb8ff276e99030c480adf8842f038876095669a0d46f7e_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c50c3087b6579a76a07038c59dd685e767ba633428d45a057247054cd5d15e19_ppc64le",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:265f3e651d16fb5416604e7b1dad78d1214f71001f6ac3a33b081d78116f616c_s390x",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:64b490a5a70c31874ba08fbe3ac00f8be2ad74198692432a8ee4762b25e40294_ppc64le",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ca7cc3adb829b0e1526c8dd4494747ed3f0b38dabdc1d9e5b67c967e4db3fb09_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:eed6a559cea86c3790258ab4d43b03618273cd59c4c2c6d484365a6d5c75e458_arm64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:f8f73e9cadc8c27f13fd947422aa74908f0cc15eb4a340bc110db757a43c6c6e_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c24477a58cd87093ac8d47ae89170cc9df4c317f85e86a0a638e2cb62c96644_s390x",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:90aee1f2623f5fb562d1badfbaa9cd993d67642ef3fe6abe523335c6e13df641_ppc64le",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c48153736d4573aa3cb6f2428fd10d1c08643cb69bc93d42512f561739243bed_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d6773be40f1cac558fe86a9dd564ba3f2570397c0dbe55e037bf05965987b43c_arm64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5b68ff2c13f4b8670d68ecf73607ea175b168d8eab620c8c666244d3a4d0b209_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:8e05f5585404218773a63e7bbc4c93c18cebec7cd963d45fa28215edffca8448_arm64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:9294e8c4a557d7c03108170a1406ca27e390c77bb71711de54567fa4830f91e7_ppc64le",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e8e63947b14543af7407ec3b4639df3f7fe52198b771473670309c00d6ca8733_s390x"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2427726"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "urllib3 is an HTTP client library for Python. urllib3\u0027s streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. urllib3 can perform decoding or decompression based on the HTTP `Content-Encoding` header (e.g., `gzip`, `deflate`, `br`, or `zstd`). When using the streaming API, the library decompresses only the necessary bytes, enabling partial content consumption. Starting in version 1.22 and prior to version 2.6.3, for HTTP redirect responses, the library would read the entire response body to drain the connection and decompress the content unnecessarily. This decompression occurred even before any read methods were called, and configured read limits did not restrict the amount of decompressed data. As a result, there was no safeguard against decompression bombs. A malicious server could exploit this to trigger excessive resource consumption on the client. Applications and libraries are affected when they stream content from untrusted sources by setting `preload_content=False` when they do not disable redirects. Users should upgrade to at least urllib3 v2.6.3, in which the library does not decode content of redirect responses when `preload_content=False`. If upgrading is not immediately possible, disable redirects by setting `redirect=False` for requests to untrusted source.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:2630957b6783b2bf14940c9a153f25e68b2f4f2cdd17f2ed3a23c284b8d71aca_s390x",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:29f466fffff1ebdb03c69b57e588d1359324280c82c67788195048aed9e022f5_ppc64le",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:945a8497173aaba167a71fb4a393714905dd2d00ede0a4eb09c00c4c59727414_amd64",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:c7cdfe50df5e73358f348f0a9b8f7b35c6a5f4298d4bb6bedae7c7b9da882108_arm64"
        ],
        "known_not_affected": [
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:237007606257d24c4dd11ba15b48a4ab4a385d7c6b259f344ac40427d965ccb7_arm64",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6bce9f138d78cd05a30d427afbd6fec50211ae3cba1174f796ec618c8862d8c7_s390x",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:bca34c5ced99ce0605bb8ff276e99030c480adf8842f038876095669a0d46f7e_amd64",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c50c3087b6579a76a07038c59dd685e767ba633428d45a057247054cd5d15e19_ppc64le",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:265f3e651d16fb5416604e7b1dad78d1214f71001f6ac3a33b081d78116f616c_s390x",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:64b490a5a70c31874ba08fbe3ac00f8be2ad74198692432a8ee4762b25e40294_ppc64le",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ca7cc3adb829b0e1526c8dd4494747ed3f0b38dabdc1d9e5b67c967e4db3fb09_amd64",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:eed6a559cea86c3790258ab4d43b03618273cd59c4c2c6d484365a6d5c75e458_arm64",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:f8f73e9cadc8c27f13fd947422aa74908f0cc15eb4a340bc110db757a43c6c6e_amd64",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c24477a58cd87093ac8d47ae89170cc9df4c317f85e86a0a638e2cb62c96644_s390x",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:90aee1f2623f5fb562d1badfbaa9cd993d67642ef3fe6abe523335c6e13df641_ppc64le",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c48153736d4573aa3cb6f2428fd10d1c08643cb69bc93d42512f561739243bed_amd64",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d6773be40f1cac558fe86a9dd564ba3f2570397c0dbe55e037bf05965987b43c_arm64",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5b68ff2c13f4b8670d68ecf73607ea175b168d8eab620c8c666244d3a4d0b209_amd64",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:8e05f5585404218773a63e7bbc4c93c18cebec7cd963d45fa28215edffca8448_arm64",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:9294e8c4a557d7c03108170a1406ca27e390c77bb71711de54567fa4830f91e7_ppc64le",
          "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e8e63947b14543af7407ec3b4639df3f7fe52198b771473670309c00d6ca8733_s390x"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-21441"
        },
        {
          "category": "external",
          "summary": "RHBZ#2427726",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2427726"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-21441",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-21441"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-21441",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21441"
        },
        {
          "category": "external",
          "summary": "https://github.com/urllib3/urllib3/commit/8864ac407bba8607950025e0979c4c69bc7abc7b",
          "url": "https://github.com/urllib3/urllib3/commit/8864ac407bba8607950025e0979c4c69bc7abc7b"
        },
        {
          "category": "external",
          "summary": "https://github.com/urllib3/urllib3/security/advisories/GHSA-38jv-5279-wg99",
          "url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-38jv-5279-wg99"
        }
      ],
      "release_date": "2026-01-07T22:09:01.936000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-02-11T05:02:44+00:00",
          "details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.13/html/multicluster_global_hub/index",
          "product_ids": [
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:2630957b6783b2bf14940c9a153f25e68b2f4f2cdd17f2ed3a23c284b8d71aca_s390x",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:29f466fffff1ebdb03c69b57e588d1359324280c82c67788195048aed9e022f5_ppc64le",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:945a8497173aaba167a71fb4a393714905dd2d00ede0a4eb09c00c4c59727414_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:c7cdfe50df5e73358f348f0a9b8f7b35c6a5f4298d4bb6bedae7c7b9da882108_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:2500"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:237007606257d24c4dd11ba15b48a4ab4a385d7c6b259f344ac40427d965ccb7_arm64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6bce9f138d78cd05a30d427afbd6fec50211ae3cba1174f796ec618c8862d8c7_s390x",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:bca34c5ced99ce0605bb8ff276e99030c480adf8842f038876095669a0d46f7e_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:c50c3087b6579a76a07038c59dd685e767ba633428d45a057247054cd5d15e19_ppc64le",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:2630957b6783b2bf14940c9a153f25e68b2f4f2cdd17f2ed3a23c284b8d71aca_s390x",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:29f466fffff1ebdb03c69b57e588d1359324280c82c67788195048aed9e022f5_ppc64le",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:945a8497173aaba167a71fb4a393714905dd2d00ede0a4eb09c00c4c59727414_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:c7cdfe50df5e73358f348f0a9b8f7b35c6a5f4298d4bb6bedae7c7b9da882108_arm64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:265f3e651d16fb5416604e7b1dad78d1214f71001f6ac3a33b081d78116f616c_s390x",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:64b490a5a70c31874ba08fbe3ac00f8be2ad74198692432a8ee4762b25e40294_ppc64le",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:ca7cc3adb829b0e1526c8dd4494747ed3f0b38dabdc1d9e5b67c967e4db3fb09_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:eed6a559cea86c3790258ab4d43b03618273cd59c4c2c6d484365a6d5c75e458_arm64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:f8f73e9cadc8c27f13fd947422aa74908f0cc15eb4a340bc110db757a43c6c6e_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c24477a58cd87093ac8d47ae89170cc9df4c317f85e86a0a638e2cb62c96644_s390x",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:90aee1f2623f5fb562d1badfbaa9cd993d67642ef3fe6abe523335c6e13df641_ppc64le",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:c48153736d4573aa3cb6f2428fd10d1c08643cb69bc93d42512f561739243bed_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d6773be40f1cac558fe86a9dd564ba3f2570397c0dbe55e037bf05965987b43c_arm64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:5b68ff2c13f4b8670d68ecf73607ea175b168d8eab620c8c666244d3a4d0b209_amd64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:8e05f5585404218773a63e7bbc4c93c18cebec7cd963d45fa28215edffca8448_arm64",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:9294e8c4a557d7c03108170a1406ca27e390c77bb71711de54567fa4830f91e7_ppc64le",
            "Red Hat multicluster global hub 1.4.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:e8e63947b14543af7407ec3b4639df3f7fe52198b771473670309c00d6ca8733_s390x"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)"
    }
  ]
}

CVE-2025-68429 (GCVE-0-2025-68429)

Vulnerability from cvelistv5 – Published: 2025-12-17 22:26 – Updated: 2025-12-18 15:06

Title

Storybook manager bundle may expose environment variables during build

Summary

Storybook is a frontend workshop for building user interface components and pages in isolation. A vulnerability present starting in versions 7.0.0 and prior to versions 7.6.21, 8.6.15, 9.1.17, and 10.1.10 relates to Storybook’s handling of environment variables defined in a `.env` file, which could, in specific circumstances, lead to those variables being unexpectedly bundled into the artifacts created by the `storybook build` command. When a built Storybook is published to the web, the bundle’s source is viewable, thus potentially exposing those variables to anyone with access. For a project to potentially be vulnerable to this issue, it must build the Storybook (i.e. run `storybook build` directly or indirectly) in a directory that contains a `.env` file (including variants like `.env.local`) and publish the built Storybook to the web. Storybooks built without a `.env` file at build time are not affected, including common CI-based builds where secrets are provided via platform environment variables rather than `.env` files. Storybook runtime environments (i.e. `storybook dev`) are not affected. Deployed applications that share a repo with your Storybook are not affected. Users should upgrade their Storybook—on both their local machines and CI environment—to version .6.21, 8.6.15, 9.1.17, or 10.1.10 as soon as possible. Maintainers additionally recommend that users audit for any sensitive secrets provided via `.env` files and rotate those keys. Some projects may have been relying on the undocumented behavior at the heart of this issue and will need to change how they reference environment variables after this update. If a project can no longer read necessary environmental variable values, either prefix the variables with `STORYBOOK_` or use the `env` property in Storybook’s configuration to manually specify values. In either case, do not include sensitive secrets as they will be included in the built bundle.

Severity ?

7.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
CWE-538 - Insertion of Sensitive Information into Externally-Accessible File or Directory
CWE-541 - Inclusion of Sensitive Information in an Include File

Assigner

GitHub_M

References

URL

Tags

	https://github.com/storybookjs/storybook/security…	x_refsource_CONFIRM
	https://storybook.js.org/blog/security-advisory	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	storybookjs	storybook	Affected: >= 7.0.0, < 7.6.21 Affected: >= 8.0.0, < 8.6.15 Affected: >= 9.0.0, < 9.1.17 Affected: >= 10.0.0, < 10.1.10

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-68429",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-18T14:52:42.162915Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-18T15:06:29.568Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "storybook",
          "vendor": "storybookjs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 7.0.0, \u003c 7.6.21"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.0.0, \u003c 8.6.15"
            },
            {
              "status": "affected",
              "version": "\u003e= 9.0.0, \u003c 9.1.17"
            },
            {
              "status": "affected",
              "version": "\u003e= 10.0.0, \u003c 10.1.10"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Storybook is a frontend workshop for building user interface components and pages in isolation. A vulnerability present starting in versions 7.0.0 and prior to versions 7.6.21, 8.6.15, 9.1.17, and 10.1.10 relates to Storybook\u2019s handling of environment variables defined in a `.env` file, which could, in specific circumstances, lead to those variables being unexpectedly bundled into the artifacts created by the `storybook build` command. When a built Storybook is published to the web, the bundle\u2019s source is viewable, thus potentially exposing those variables to anyone with access. For a project to potentially be vulnerable to this issue, it must build the Storybook (i.e. run `storybook build` directly or indirectly) in a directory that contains a `.env` file (including variants like `.env.local`) and publish the built Storybook to the web. Storybooks built without a `.env` file at build time are not affected, including common CI-based builds where secrets are provided via platform environment variables rather than `.env` files. Storybook runtime environments (i.e. `storybook dev`) are not affected. Deployed applications that share a repo with your Storybook are not affected. Users should upgrade their Storybook\u2014on both their local machines and CI environment\u2014to version .6.21, 8.6.15, 9.1.17, or 10.1.10 as soon as possible. Maintainers additionally recommend that users audit for any sensitive secrets provided via `.env` files and rotate those keys. Some projects may have been relying on the undocumented behavior at the heart of this issue and will need to change how they reference environment variables after this update. If a project can no longer read necessary environmental variable values, either prefix the variables with `STORYBOOK_` or use the `env` property in Storybook\u2019s configuration to manually specify values. In either case, do not include sensitive secrets as they will be included in the built bundle."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-538",
              "description": "CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-541",
              "description": "CWE-541: Inclusion of Sensitive Information in an Include File",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-17T22:26:55.732Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/storybookjs/storybook/security/advisories/GHSA-8452-54wp-rmv6",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/storybookjs/storybook/security/advisories/GHSA-8452-54wp-rmv6"
        },
        {
          "name": "https://storybook.js.org/blog/security-advisory",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://storybook.js.org/blog/security-advisory"
        }
      ],
      "source": {
        "advisory": "GHSA-8452-54wp-rmv6",
        "discovery": "UNKNOWN"
      },
      "title": "Storybook manager bundle may expose environment variables during build"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-68429",
    "datePublished": "2025-12-17T22:26:55.732Z",
    "dateReserved": "2025-12-17T15:29:39.379Z",
    "dateUpdated": "2025-12-18T15:06:29.568Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-66418 (GCVE-0-2025-66418)

Vulnerability from cvelistv5 – Published: 2025-12-05 16:02 – Updated: 2025-12-05 18:15

Title

urllib3 allows an unbounded number of links in the decompression chain

Summary

urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data. This vulnerability is fixed in 2.6.0.

Severity ?

8.9 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

GitHub_M

References

URL

Tags

	https://github.com/urllib3/urllib3/security/advis…	x_refsource_CONFIRM
	https://github.com/urllib3/urllib3/commit/24d7b67…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	urllib3	urllib3	Affected: >= 1.24, < 2.6.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-66418",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-05T16:15:39.701596Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-05T16:16:08.790Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "urllib3",
          "vendor": "urllib3",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.24, \u003c 2.6.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data. This vulnerability is fixed in 2.6.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.9,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-05T18:15:28.505Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/urllib3/urllib3/security/advisories/GHSA-gm62-xv2j-4w53",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-gm62-xv2j-4w53"
        },
        {
          "name": "https://github.com/urllib3/urllib3/commit/24d7b67eac89f94e11003424bcf0d8f7b72222a8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/urllib3/urllib3/commit/24d7b67eac89f94e11003424bcf0d8f7b72222a8"
        }
      ],
      "source": {
        "advisory": "GHSA-gm62-xv2j-4w53",
        "discovery": "UNKNOWN"
      },
      "title": "urllib3 allows an unbounded number of links in the decompression chain"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-66418",
    "datePublished": "2025-12-05T16:02:15.271Z",
    "dateReserved": "2025-11-28T23:33:56.367Z",
    "dateUpdated": "2025-12-05T18:15:28.505Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-12816 (GCVE-0-2025-12816)

Vulnerability from cvelistv5 – Published: 2025-11-25 19:15 – Updated: 2025-11-25 21:04

Title

CVE-2025-12816

Summary

An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence that may bypass downstream cryptographic verifications and security decisions.

Severity ?

No CVSS data available.

CWE

CWE-436 Interpretation Conflict

Assigner

certcc

References

URL

Tags

	https://www.npmjs.com/package/node-forge
	https://github.com/digitalbazaar/forge/pull/1124
	https://github.com/digitalbazaar/forge
	https://kb.cert.org/vuls/id/521113	third-party-advisory
	https://github.com/digitalbazaar/forge/security/a…	third-party-advisory

Impacted products

Vendor

Product

Version

Digital Bazaar

node-forge

Affected: 0 , ≤ 1.3.1 (semver)

Digital Bazaar

forge

Affected: 0 , ≤ 1.3.1 (semver)

Credits

This issue was reported by Hunter Wodzenski of Palo Alto Networks

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 8.6,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-12816",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-11-25T20:21:37.225634Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-436",
                "description": "CWE-436 Interpretation Conflict",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-11-25T20:24:22.734Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-25T21:04:09.432Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://www.kb.cert.org/vuls/id/521113"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "node-forge",
          "vendor": "Digital Bazaar",
          "versions": [
            {
              "lessThanOrEqual": "1.3.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "product": "forge",
          "vendor": "Digital Bazaar",
          "versions": [
            {
              "lessThanOrEqual": "1.3.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "This issue was reported by Hunter Wodzenski of Palo Alto Networks"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1 structures to desynchronize schema validations, yielding a semantic divergence that may bypass downstream cryptographic verifications and security decisions."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "schemaVersion": "2.0.0",
              "selections": [
                {
                  "definition": "The present state of exploitation of the vulnerability.",
                  "key": "E",
                  "name": "Exploitation",
                  "namespace": "ssvc",
                  "values": [
                    {
                      "key": "P",
                      "name": "Public PoC"
                    }
                  ],
                  "version": "1.1.0"
                },
                {
                  "definition": "Can an attacker reliably automate creating exploitation events for this vulnerability?",
                  "key": "A",
                  "name": "Automatable",
                  "namespace": "ssvc",
                  "values": [
                    {
                      "key": "N",
                      "name": "No"
                    }
                  ],
                  "version": "2.0.0"
                },
                {
                  "definition": "The technical impact of the vulnerability.",
                  "key": "TI",
                  "name": "Technical Impact",
                  "namespace": "ssvc",
                  "values": [
                    {
                      "key": "P",
                      "name": "Partial"
                    }
                  ],
                  "version": "1.0.0"
                }
              ],
              "timestamp": "2025-11-07T15:47:01.238Z"
            },
            "type": "ssvcV2_0_0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-436 Interpretation Conflict",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-11-25T19:29:31.487Z",
        "orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
        "shortName": "certcc"
      },
      "references": [
        {
          "url": "https://www.npmjs.com/package/node-forge"
        },
        {
          "url": "https://github.com/digitalbazaar/forge/pull/1124"
        },
        {
          "url": "https://github.com/digitalbazaar/forge"
        },
        {
          "name": "CERT/CC Vulnerability Notice",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://kb.cert.org/vuls/id/521113"
        },
        {
          "name": "Github Security Advisory",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://github.com/digitalbazaar/forge/security/advisories/GHSA-5gfm-wpxj-wjgq"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "CVE-2025-12816",
      "x_generator": {
        "engine": "VINCE 3.0.29",
        "env": "prod",
        "origin": "https://cveawg.mitre.org/api/cve/CVE-2025-12816"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
    "assignerShortName": "certcc",
    "cveId": "CVE-2025-12816",
    "datePublished": "2025-11-25T19:15:50.243Z",
    "dateReserved": "2025-11-06T17:11:38.255Z",
    "dateUpdated": "2025-11-25T21:04:09.432Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-66471 (GCVE-0-2025-66471)

Vulnerability from cvelistv5 – Published: 2025-12-05 16:06 – Updated: 2025-12-05 19:33

Title

urllib3 Streaming API improperly handles highly compressed data

Summary

urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly compressed data. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. When streaming a compressed response, urllib3 can perform decoding or decompression based on the HTTP Content-Encoding header (e.g., gzip, deflate, br, or zstd). The library must read compressed data from the network and decompress it until the requested chunk size is met. Any resulting decompressed data that exceeds the requested amount is held in an internal buffer for the next read operation. The decompression logic could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This can result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data.

Severity ?

8.9 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

CWE

CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification)

Assigner

GitHub_M

References

URL

Tags

	https://github.com/urllib3/urllib3/security/advis…	x_refsource_CONFIRM
	https://github.com/urllib3/urllib3/commit/c19571d…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	urllib3	urllib3	Affected: >= 1.0, < 2.6.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-66471",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-05T19:32:57.089218Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-05T19:33:14.832Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "urllib3",
          "vendor": "urllib3",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.0, \u003c 2.6.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly compressed data. urllib3\u0027s streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. When streaming a compressed response, urllib3 can perform decoding or decompression based on the HTTP Content-Encoding header (e.g., gzip, deflate, br, or zstd). The library must read compressed data from the network and decompress it until the requested chunk size is met. Any resulting decompressed data that exceeds the requested amount is held in an internal buffer for the next read operation. The decompression logic could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This can result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.9,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-409",
              "description": "CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-05T16:06:08.531Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/urllib3/urllib3/security/advisories/GHSA-2xpw-w6gg-jr37",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-2xpw-w6gg-jr37"
        },
        {
          "name": "https://github.com/urllib3/urllib3/commit/c19571de34c47de3a766541b041637ba5f716ed7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/urllib3/urllib3/commit/c19571de34c47de3a766541b041637ba5f716ed7"
        }
      ],
      "source": {
        "advisory": "GHSA-2xpw-w6gg-jr37",
        "discovery": "UNKNOWN"
      },
      "title": "urllib3 Streaming API improperly handles highly compressed data"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-66471",
    "datePublished": "2025-12-05T16:06:08.531Z",
    "dateReserved": "2025-12-02T15:43:16.586Z",
    "dateUpdated": "2025-12-05T19:33:14.832Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-15284 (GCVE-0-2025-15284)

Vulnerability from cvelistv5 – Published: 2025-12-29 22:56 – Updated: 2026-02-10 20:06

Title

arrayLimit bypass in bracket notation allows DoS via memory exhaustion

Summary

Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1. Summary The arrayLimit option in qs did not enforce limits for bracket notation (a[]=1&a[]=2), only for indexed notation (a[0]=1). This is a consistency bug; arrayLimit should apply uniformly across all array notations. Note: The default parameterLimit of 1000 effectively mitigates the DoS scenario originally described. With default options, bracket notation cannot produce arrays larger than parameterLimit regardless of arrayLimit, because each a[]=valueconsumes one parameter slot. The severity has been reduced accordingly. Details The arrayLimit option only checked limits for indexed notation (a[0]=1&a[1]=2) but did not enforce it for bracket notation (a[]=1&a[]=2). Vulnerable code (lib/parse.js:159-162): if (root === '[]' && options.parseArrays) { obj = utils.combine([], leaf); // No arrayLimit check } Working code (lib/parse.js:175): else if (index <= options.arrayLimit) { // Limit checked here obj = []; obj[index] = leaf; } The bracket notation handler at line 159 uses utils.combine([], leaf) without validating against options.arrayLimit, while indexed notation at line 175 checks index <= options.arrayLimit before creating arrays. PoC const qs = require('qs'); const result = qs.parse('a[]=1&a[]=2&a[]=3&a[]=4&a[]=5&a[]=6', { arrayLimit: 5 }); console.log(result.a.length); // Output: 6 (should be max 5) Note on parameterLimit interaction: The original advisory's "DoS demonstration" claimed a length of 10,000, but parameterLimit (default: 1000) caps parsing to 1,000 parameters. With default options, the actual output is 1,000, not 10,000. Impact Consistency bug in arrayLimit enforcement. With default parameterLimit, the practical DoS risk is negligible since parameterLimit already caps the total number of parsed parameters (and thus array elements from bracket notation). The risk increases only when parameterLimit is explicitly set to a very high value.

Severity ?

6.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L

3.7 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE

CWE-20 - Improper Input Validation

Assigner

harborist

References

URL

Tags

	https://github.com/ljharb/qs/security/advisories/…	vendor-advisory
	https://github.com/ljharb/qs/commit/3086902ecf7f0…	patch

Impacted products

	Vendor	Product	Version
			Affected: < 6.14.1 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-15284",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-30T14:55:26.031863Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-30T15:57:41.402Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://npmjs.com/qs",
          "defaultStatus": "affected",
          "modules": [
            "parse"
          ],
          "packageName": "qs",
          "repo": "https://github.com/ljharb/qs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 6.14.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.\u003cp\u003eThis issue affects qs: \u0026lt; 6.14.1.\u003c/p\u003e\u003ch3\u003e\u003cbr\u003eSummary\u003c/h3\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003eThe \u003ccode\u003earrayLimit\u003c/code\u003e\u0026nbsp;option in qs did not enforce limits for bracket notation (\u003ccode\u003ea[]=1\u0026amp;a[]=2\u003c/code\u003e), only for indexed notation (\u003ccode\u003ea[0]=1\u003c/code\u003e). This is a consistency bug; \u003ccode\u003earrayLimit\u003c/code\u003e\u0026nbsp;should apply uniformly across all array notations.\u003c/p\u003e\u003cp\u003e\u003cstrong\u003eNote:\u003c/strong\u003e\u0026nbsp;The default \u003ccode\u003eparameterLimit\u003c/code\u003e\u0026nbsp;of 1000 effectively mitigates the DoS scenario originally described. With default options, bracket notation cannot produce arrays larger than \u003ccode\u003eparameterLimit\u003c/code\u003e\u0026nbsp;regardless of \u003ccode\u003earrayLimit\u003c/code\u003e, because each \u003ccode\u003ea[]=value\u003c/code\u003econsumes one parameter slot. The severity has been reduced accordingly.\u003c/p\u003e\u003ch3\u003eDetails\u003c/h3\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003eThe \u003ccode\u003earrayLimit\u003c/code\u003e\u0026nbsp;option only checked limits for indexed notation (\u003ccode\u003ea[0]=1\u0026amp;a[1]=2\u003c/code\u003e) but did not enforce it for bracket notation (\u003ccode\u003ea[]=1\u0026amp;a[]=2\u003c/code\u003e).\u003c/p\u003e\u003cp\u003e\u003cstrong\u003eVulnerable code\u003c/strong\u003e\u0026nbsp;(\u003ccode\u003elib/parse.js:159-162\u003c/code\u003e):\u003c/p\u003e\u003cdiv\u003e\u003cpre\u003eif (root === \u0027[]\u0027 \u0026amp;\u0026amp; options.parseArrays) {\n    obj = utils.combine([], leaf);  // No arrayLimit check\n}\u003c/pre\u003e\u003cdiv\u003e\u003c/div\u003e\u003c/div\u003e\u003cp\u003e\u003cstrong\u003eWorking code\u003c/strong\u003e\u0026nbsp;(\u003ccode\u003elib/parse.js:175\u003c/code\u003e):\u003c/p\u003e\u003cdiv\u003e\u003cpre\u003eelse if (index \u0026lt;= options.arrayLimit) {  // Limit checked here\n    obj = [];\n    obj[index] = leaf;\n}\u003c/pre\u003e\u003cdiv\u003e\u003c/div\u003e\u003c/div\u003e\u003cp\u003eThe bracket notation handler at line 159 uses \u003ccode\u003eutils.combine([], leaf)\u003c/code\u003e\u0026nbsp;without validating against \u003ccode\u003eoptions.arrayLimit\u003c/code\u003e, while indexed notation at line 175 checks \u003ccode\u003eindex \u0026lt;= options.arrayLimit\u003c/code\u003e\u0026nbsp;before creating arrays.\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003ch3\u003ePoC\u003c/h3\u003e\u003cp\u003e\u003cstrong\u003e\u003c/strong\u003e\u003c/p\u003e\u003cdiv\u003e\u003cpre\u003econst qs = require(\u0027qs\u0027);\nconst result = qs.parse(\u0027a[]=1\u0026amp;a[]=2\u0026amp;a[]=3\u0026amp;a[]=4\u0026amp;a[]=5\u0026amp;a[]=6\u0027, { arrayLimit: 5 });\nconsole.log(result.a.length);  // Output: 6 (should be max 5)\u003c/pre\u003e\u003cdiv\u003e\u003c/div\u003e\u003c/div\u003e\u003cp\u003e\u003cstrong\u003eNote on parameterLimit interaction:\u003c/strong\u003e\u0026nbsp;The original advisory\u0027s \"DoS demonstration\" claimed a length of 10,000, but \u003ccode\u003eparameterLimit\u003c/code\u003e\u0026nbsp;(default: 1000) caps parsing to 1,000 parameters. With default options, the actual output is 1,000, not 10,000.\u003c/p\u003e\u003ch3\u003eImpact\u003c/h3\u003e\u003cp\u003e\u003c/p\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eConsistency bug in \u003c/span\u003e\u003ccode\u003earrayLimit\u003c/code\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;enforcement. With default \u003c/span\u003e\u003ccode\u003eparameterLimit\u003c/code\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e, the practical DoS risk is negligible since \u003c/span\u003e\u003ccode\u003eparameterLimit\u003c/code\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;already caps the total number of parsed parameters (and thus array elements from bracket notation). The risk increases only when \u003c/span\u003e\u003ccode\u003eparameterLimit\u003c/code\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;is explicitly set to a very high value.\u003c/span\u003e"
            }
          ],
          "value": "Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: \u003c 6.14.1.\n\n\nSummary\n\nThe arrayLimit\u00a0option in qs did not enforce limits for bracket notation (a[]=1\u0026a[]=2), only for indexed notation (a[0]=1). This is a consistency bug; arrayLimit\u00a0should apply uniformly across all array notations.\n\nNote:\u00a0The default parameterLimit\u00a0of 1000 effectively mitigates the DoS scenario originally described. With default options, bracket notation cannot produce arrays larger than parameterLimit\u00a0regardless of arrayLimit, because each a[]=valueconsumes one parameter slot. The severity has been reduced accordingly.\n\nDetails\n\nThe arrayLimit\u00a0option only checked limits for indexed notation (a[0]=1\u0026a[1]=2) but did not enforce it for bracket notation (a[]=1\u0026a[]=2).\n\nVulnerable code\u00a0(lib/parse.js:159-162):\n\nif (root === \u0027[]\u0027 \u0026\u0026 options.parseArrays) {\n    obj = utils.combine([], leaf);  // No arrayLimit check\n}\n\n\n\n\n\nWorking code\u00a0(lib/parse.js:175):\n\nelse if (index \u003c= options.arrayLimit) {  // Limit checked here\n    obj = [];\n    obj[index] = leaf;\n}\n\n\n\n\n\nThe bracket notation handler at line 159 uses utils.combine([], leaf)\u00a0without validating against options.arrayLimit, while indexed notation at line 175 checks index \u003c= options.arrayLimit\u00a0before creating arrays.\n\n\n\nPoC\n\nconst qs = require(\u0027qs\u0027);\nconst result = qs.parse(\u0027a[]=1\u0026a[]=2\u0026a[]=3\u0026a[]=4\u0026a[]=5\u0026a[]=6\u0027, { arrayLimit: 5 });\nconsole.log(result.a.length);  // Output: 6 (should be max 5)\n\n\n\n\n\nNote on parameterLimit interaction:\u00a0The original advisory\u0027s \"DoS demonstration\" claimed a length of 10,000, but parameterLimit\u00a0(default: 1000) caps parsing to 1,000 parameters. With default options, the actual output is 1,000, not 10,000.\n\nImpact\n\nConsistency bug in arrayLimit\u00a0enforcement. With default parameterLimit, the practical DoS risk is negligible since parameterLimit\u00a0already caps the total number of parsed parameters (and thus array elements from bracket notation). The risk increases only when parameterLimit\u00a0is explicitly set to a very high value."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-469",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-469 HTTP DoS"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "LOW",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-10T20:06:42.111Z",
        "orgId": "7ffcee3d-2c14-4c3e-b844-86c6a321a158",
        "shortName": "harborist"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/ljharb/qs/security/advisories/GHSA-6rw7-vpxm-498p"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/ljharb/qs/commit/3086902ecf7f088d0d1803887643ac6c03d415b9"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "arrayLimit bypass in bracket notation allows DoS via memory exhaustion",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7ffcee3d-2c14-4c3e-b844-86c6a321a158",
    "assignerShortName": "harborist",
    "cveId": "CVE-2025-15284",
    "datePublished": "2025-12-29T22:56:45.240Z",
    "dateReserved": "2025-12-29T21:36:51.399Z",
    "dateUpdated": "2026-02-10T20:06:42.111Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-21441 (GCVE-0-2026-21441)

Vulnerability from cvelistv5 – Published: 2026-01-07 22:09 – Updated: 2026-01-23 09:07

Title

urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)

Summary

urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. urllib3 can perform decoding or decompression based on the HTTP `Content-Encoding` header (e.g., `gzip`, `deflate`, `br`, or `zstd`). When using the streaming API, the library decompresses only the necessary bytes, enabling partial content consumption. Starting in version 1.22 and prior to version 2.6.3, for HTTP redirect responses, the library would read the entire response body to drain the connection and decompress the content unnecessarily. This decompression occurred even before any read methods were called, and configured read limits did not restrict the amount of decompressed data. As a result, there was no safeguard against decompression bombs. A malicious server could exploit this to trigger excessive resource consumption on the client. Applications and libraries are affected when they stream content from untrusted sources by setting `preload_content=False` when they do not disable redirects. Users should upgrade to at least urllib3 v2.6.3, in which the library does not decode content of redirect responses when `preload_content=False`. If upgrading is not immediately possible, disable redirects by setting `redirect=False` for requests to untrusted source.

Severity ?

8.9 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

CWE

CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification)

Assigner

GitHub_M

References

URL

Tags

	https://github.com/urllib3/urllib3/security/advis…	x_refsource_CONFIRM
	https://github.com/urllib3/urllib3/commit/8864ac4…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	urllib3	urllib3	Affected: >= 1.22, < 2.6.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-21441",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-08T20:08:04.959214Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-08T20:08:22.320Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-01-23T09:07:22.785Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2026/01/msg00017.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "urllib3",
          "vendor": "urllib3",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.22, \u003c 2.6.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "urllib3 is an HTTP client library for Python. urllib3\u0027s streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. urllib3 can perform decoding or decompression based on the HTTP `Content-Encoding` header (e.g., `gzip`, `deflate`, `br`, or `zstd`). When using the streaming API, the library decompresses only the necessary bytes, enabling partial content consumption. Starting in version 1.22 and prior to version 2.6.3, for HTTP redirect responses, the library would read the entire response body to drain the connection and decompress the content unnecessarily. This decompression occurred even before any read methods were called, and configured read limits did not restrict the amount of decompressed data. As a result, there was no safeguard against decompression bombs. A malicious server could exploit this to trigger excessive resource consumption on the client. Applications and libraries are affected when they stream content from untrusted sources by setting `preload_content=False` when they do not disable redirects. Users should upgrade to at least urllib3 v2.6.3, in which the library does not decode content of redirect responses when `preload_content=False`. If upgrading is not immediately possible, disable redirects by setting `redirect=False` for requests to untrusted source."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.9,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-409",
              "description": "CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-07T22:13:57.482Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/urllib3/urllib3/security/advisories/GHSA-38jv-5279-wg99",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-38jv-5279-wg99"
        },
        {
          "name": "https://github.com/urllib3/urllib3/commit/8864ac407bba8607950025e0979c4c69bc7abc7b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/urllib3/urllib3/commit/8864ac407bba8607950025e0979c4c69bc7abc7b"
        }
      ],
      "source": {
        "advisory": "GHSA-38jv-5279-wg99",
        "discovery": "UNKNOWN"
      },
      "title": "urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-21441",
    "datePublished": "2026-01-07T22:09:01.936Z",
    "dateReserved": "2025-12-29T03:00:29.276Z",
    "dateUpdated": "2026-01-23T09:07:22.785Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

RHSA-2026:2500

CVE-2025-68429 (GCVE-0-2025-68429)

CVE-2025-66418 (GCVE-0-2025-66418)

CVE-2025-12816 (GCVE-0-2025-12816)

CVE-2025-66471 (GCVE-0-2025-66471)

CVE-2025-15284 (GCVE-0-2025-15284)

CVE-2026-21441 (GCVE-0-2026-21441)

Tags

Sightings

Nomenclature