RHSA-2026:36862
Vulnerability from csaf_redhat - Published: 2026-07-08 20:16 - Updated: 2026-07-29 03:45Summary
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
Severity
Moderate
Notes
Topic: An update for Red Hat Hardened Images RPMs is now available.
Details: This update includes the following RPMs:
hugo:
* hugo-0.163.3-0.1.hum1 (aarch64, x86_64)
* hugo-0.163.3-0.1.hum1.src (src)
Security Fix(es):
hugo:
* CVE-2026-58402
* CVE-2026-58403
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in Hugo, a static site generator. This vulnerability allows a remote attacker to perform stored cross-site scripting (XSS) by ingesting untrusted HTML content files. When a site processes these malicious files, the embedded script is executed verbatim in the rendered page, potentially leading to unauthorized actions or information disclosure in a user's browser.
6.1 (Medium)
Affected products
Threats
Impact
Moderate
A flaw was found in Hugo, a static site generator. The default code-block renderer failed to properly escape Markdown code-fence language or info-strings. This vulnerability allows an attacker to inject malicious script elements into web pages, leading to Cross-site Scripting (XSS). Successful exploitation could result in arbitrary code execution within a user's browser.
5.4 (Medium)
Affected products
Threats
Impact
Moderate
A flaw was found in Hugo, a static site generator. A regression in its virtual filesystem allowed a symlink (symbolic link) planted within a theme or local mount to bypass security restrictions. This could enable an attacker to read arbitrary files on the system where Hugo is running, leading to information disclosure.
6.5 (Medium)
Affected products
Threats
Impact
Moderate
A flaw was found in Hugo, a static site generator. The default security policy intended to deny requests to loopback, internal, and cloud-metadata IPv4 addresses could be bypassed. This occurred because the deny rule only matched dotted-decimal notation, allowing alternate IPv4 encodings (integer, hex, or octal) to pass the policy. When a template processes an untrusted URL, this vulnerability could lead to Server-Side Request Forgery (SSRF), enabling access to internal services or cloud-metadata endpoints during the build process.
6.8 (Medium)
Affected products
Threats
Impact
Moderate
References
37 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for Red Hat Hardened Images RPMs is now available.",
"title": "Topic"
},
{
"category": "general",
"text": "This update includes the following RPMs:\n\nhugo:\n * hugo-0.163.3-0.1.hum1 (aarch64, x86_64)\n * hugo-0.163.3-0.1.hum1.src (src)\n\nSecurity Fix(es):\n\nhugo:\n * CVE-2026-58402\n * CVE-2026-58403",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:36862",
"url": "https://access.redhat.com/errata/RHSA-2026:36862"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-58402",
"url": "https://access.redhat.com/security/cve/CVE-2026-58402"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-58403",
"url": "https://access.redhat.com/security/cve/CVE-2026-58403"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://images.redhat.com/",
"url": "https://images.redhat.com/"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-50133",
"url": "https://access.redhat.com/security/cve/CVE-2026-50133"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-58404",
"url": "https://access.redhat.com/security/cve/CVE-2026-58404"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_36862.json"
}
],
"title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
"tracking": {
"current_release_date": "2026-07-29T03:45:35+00:00",
"generator": {
"date": "2026-07-29T03:45:35+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.7"
}
},
"id": "RHSA-2026:36862",
"initial_release_date": "2026-07-08T20:16:29+00:00",
"revision_history": [
{
"date": "2026-07-08T20:16:29+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-07-25T05:39:32+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-07-29T03:45:35+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Hardened Images",
"product": {
"name": "Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:hummingbird:1"
}
}
}
],
"category": "product_family",
"name": "Red Hat Hardened Images"
},
{
"branches": [
{
"category": "product_version",
"name": "hugo-main@aarch64",
"product": {
"name": "hugo-main@aarch64",
"product_id": "hugo-main@aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/hugo@0.163.3-0.1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "hugo-main@src",
"product": {
"name": "hugo-main@src",
"product_id": "hugo-main@src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/hugo@0.163.3-0.1.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "hugo-main@x86_64",
"product": {
"name": "hugo-main@x86_64",
"product_id": "hugo-main@x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/hugo@0.163.3-0.1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "hugo-main@aarch64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:hugo-main@aarch64"
},
"product_reference": "hugo-main@aarch64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "hugo-main@src as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:hugo-main@src"
},
"product_reference": "hugo-main@src",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "hugo-main@x86_64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:hugo-main@x86_64"
},
"product_reference": "hugo-main@x86_64",
"relates_to_product_reference": "Red Hat Hardened Images"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-50133",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2026-07-06T20:02:18.047552+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2497463"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Hugo, a static site generator. This vulnerability allows a remote attacker to perform stored cross-site scripting (XSS) by ingesting untrusted HTML content files. When a site processes these malicious files, the embedded script is executed verbatim in the rendered page, potentially leading to unauthorized actions or information disclosure in a user\u0027s browser.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/gohugoio/hugo: Hugo: Cross-site Scripting via untrusted HTML content files",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:hugo-main@aarch64",
"Red Hat Hardened Images:hugo-main@src",
"Red Hat Hardened Images:hugo-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-50133"
},
{
"category": "external",
"summary": "RHBZ#2497463",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497463"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-50133",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-50133"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-50133",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50133"
},
{
"category": "external",
"summary": "https://github.com/gohugoio/hugo/commit/e41a06447daa3071a01f333fdcec0a5153c3c8d1",
"url": "https://github.com/gohugoio/hugo/commit/e41a06447daa3071a01f333fdcec0a5153c3c8d1"
},
{
"category": "external",
"summary": "https://github.com/gohugoio/hugo/releases/tag/v0.162.0",
"url": "https://github.com/gohugoio/hugo/releases/tag/v0.162.0"
},
{
"category": "external",
"summary": "https://github.com/gohugoio/hugo/security/advisories/GHSA-c54g-xjwj-8g82",
"url": "https://github.com/gohugoio/hugo/security/advisories/GHSA-c54g-xjwj-8g82"
}
],
"release_date": "2026-07-06T19:31:18.386000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-08T20:16:29+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:hugo-main@aarch64",
"Red Hat Hardened Images:hugo-main@src",
"Red Hat Hardened Images:hugo-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:36862"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:hugo-main@aarch64",
"Red Hat Hardened Images:hugo-main@src",
"Red Hat Hardened Images:hugo-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "github.com/gohugoio/hugo: Hugo: Cross-site Scripting via untrusted HTML content files"
},
{
"cve": "CVE-2026-58402",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2026-07-06T20:02:32.795910+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2497467"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Hugo, a static site generator. The default code-block renderer failed to properly escape Markdown code-fence language or info-strings. This vulnerability allows an attacker to inject malicious script elements into web pages, leading to Cross-site Scripting (XSS). Successful exploitation could result in arbitrary code execution within a user\u0027s browser.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/gohugoio/hugo: Hugo: Cross-site Scripting via unescaped code-fence language in default code block renderer",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:hugo-main@aarch64",
"Red Hat Hardened Images:hugo-main@src",
"Red Hat Hardened Images:hugo-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-58402"
},
{
"category": "external",
"summary": "RHBZ#2497467",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497467"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-58402",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58402"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-58402",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58402"
},
{
"category": "external",
"summary": "https://github.com/gohugoio/hugo/commit/ce1a7e0bce3713af40496ded3c2c0ceeed49231d",
"url": "https://github.com/gohugoio/hugo/commit/ce1a7e0bce3713af40496ded3c2c0ceeed49231d"
},
{
"category": "external",
"summary": "https://github.com/gohugoio/hugo/pull/15051",
"url": "https://github.com/gohugoio/hugo/pull/15051"
},
{
"category": "external",
"summary": "https://github.com/gohugoio/hugo/releases/tag/v0.163.3",
"url": "https://github.com/gohugoio/hugo/releases/tag/v0.163.3"
},
{
"category": "external",
"summary": "https://github.com/gohugoio/hugo/security/advisories/GHSA-q76j-gcg9-vxc6",
"url": "https://github.com/gohugoio/hugo/security/advisories/GHSA-q76j-gcg9-vxc6"
}
],
"release_date": "2026-07-06T19:19:58.754000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-08T20:16:29+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:hugo-main@aarch64",
"Red Hat Hardened Images:hugo-main@src",
"Red Hat Hardened Images:hugo-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:36862"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:hugo-main@aarch64",
"Red Hat Hardened Images:hugo-main@src",
"Red Hat Hardened Images:hugo-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "github.com/gohugoio/hugo: Hugo: Cross-site Scripting via unescaped code-fence language in default code block renderer"
},
{
"cve": "CVE-2026-58403",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-07-06T20:02:05.850205+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2497460"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Hugo, a static site generator. A regression in its virtual filesystem allowed a symlink (symbolic link) planted within a theme or local mount to bypass security restrictions. This could enable an attacker to read arbitrary files on the system where Hugo is running, leading to information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/gohugoio/hugo: Hugo: Information disclosure via symlink confinement bypass in virtual filesystem",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:hugo-main@aarch64",
"Red Hat Hardened Images:hugo-main@src",
"Red Hat Hardened Images:hugo-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-58403"
},
{
"category": "external",
"summary": "RHBZ#2497460",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497460"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-58403",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58403"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-58403",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58403"
},
{
"category": "external",
"summary": "https://github.com/gohugoio/hugo/commit/cf9c8f93ca2a2838ce378f9e36d052ac2f79e229",
"url": "https://github.com/gohugoio/hugo/commit/cf9c8f93ca2a2838ce378f9e36d052ac2f79e229"
},
{
"category": "external",
"summary": "https://github.com/gohugoio/hugo/pull/15020",
"url": "https://github.com/gohugoio/hugo/pull/15020"
},
{
"category": "external",
"summary": "https://github.com/gohugoio/hugo/releases/tag/v0.163.1",
"url": "https://github.com/gohugoio/hugo/releases/tag/v0.163.1"
},
{
"category": "external",
"summary": "https://github.com/gohugoio/hugo/security/advisories/GHSA-c3wq-j5vh-68rc",
"url": "https://github.com/gohugoio/hugo/security/advisories/GHSA-c3wq-j5vh-68rc"
}
],
"release_date": "2026-07-06T19:25:45.971000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-08T20:16:29+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:hugo-main@aarch64",
"Red Hat Hardened Images:hugo-main@src",
"Red Hat Hardened Images:hugo-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:36862"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:hugo-main@aarch64",
"Red Hat Hardened Images:hugo-main@src",
"Red Hat Hardened Images:hugo-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "github.com/gohugoio/hugo: Hugo: Information disclosure via symlink confinement bypass in virtual filesystem"
},
{
"cve": "CVE-2026-58404",
"cwe": {
"id": "CWE-918",
"name": "Server-Side Request Forgery (SSRF)"
},
"discovery_date": "2026-07-06T20:01:18.820943+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2497450"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Hugo, a static site generator. The default security policy intended to deny requests to loopback, internal, and cloud-metadata IPv4 addresses could be bypassed. This occurred because the deny rule only matched dotted-decimal notation, allowing alternate IPv4 encodings (integer, hex, or octal) to pass the policy. When a template processes an untrusted URL, this vulnerability could lead to Server-Side Request Forgery (SSRF), enabling access to internal services or cloud-metadata endpoints during the build process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/gohugoio/hugo: Hugo: Server-Side Request Forgery (SSRF) via alternate IPv4 encodings",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:hugo-main@aarch64",
"Red Hat Hardened Images:hugo-main@src",
"Red Hat Hardened Images:hugo-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-58404"
},
{
"category": "external",
"summary": "RHBZ#2497450",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497450"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-58404",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58404"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-58404",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58404"
},
{
"category": "external",
"summary": "https://github.com/gohugoio/hugo/commit/a00b5c72ac57afe26df6688ece3ca544a56df372",
"url": "https://github.com/gohugoio/hugo/commit/a00b5c72ac57afe26df6688ece3ca544a56df372"
},
{
"category": "external",
"summary": "https://github.com/gohugoio/hugo/pull/15020",
"url": "https://github.com/gohugoio/hugo/pull/15020"
},
{
"category": "external",
"summary": "https://github.com/gohugoio/hugo/releases/tag/v0.163.1",
"url": "https://github.com/gohugoio/hugo/releases/tag/v0.163.1"
},
{
"category": "external",
"summary": "https://github.com/gohugoio/hugo/security/advisories/GHSA-r46f-3rpw-hxrv",
"url": "https://github.com/gohugoio/hugo/security/advisories/GHSA-r46f-3rpw-hxrv"
}
],
"release_date": "2026-07-06T19:16:15.945000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-07-08T20:16:29+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:hugo-main@aarch64",
"Red Hat Hardened Images:hugo-main@src",
"Red Hat Hardened Images:hugo-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:36862"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:hugo-main@aarch64",
"Red Hat Hardened Images:hugo-main@src",
"Red Hat Hardened Images:hugo-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "github.com/gohugoio/hugo: Hugo: Server-Side Request Forgery (SSRF) via alternate IPv4 encodings"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
Loading…
Loading…