Vulnerability-Lookup

RHSA-2026:67517

Vulnerability from csaf_redhat - Published: 2026-09-15 10:06 - Updated: 2026-09-16 10:52

Summary

Red Hat Security Advisory: grafana security update

Severity

Important

Notes

Topic: An update for grafana is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): * crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137) * crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application (CVE-2026-33810) * net/mail: golang: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499) * net/mail: golang: Go net/mail: Denial of Service via crafted email inputs (CVE-2026-39820) * grafana: Grafana: Privilege escalation via dashboard overwrite (CVE-2026-33377) * grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default (CVE-2026-33376) * golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) * golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136) * golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681) * golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering (CVE-2026-42502) * grafana: Grafana: Denial of Service due to excessive memory allocation via large JSON payloads (CVE-2026-42127) * grafana: Grafana: Denial of Service via unbounded memory growth in OAuth login route (CVE-2026-8609) * grafana: Grafana: Denial of Service via excessive memory allocation from large API request payloads (CVE-2026-33382) * encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818) * net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860) * net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853) * html/template: golang: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858) * crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862) * encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-8609

A flaw was found in Grafana. An unauthenticated attacker can repeatedly access the OAuth login route with unique values. This can lead to unbounded memory growth, eventually exhausting system memory and causing the Grafana instance to crash. This results in a denial of service for legitimate users.

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 17 products

Product	Version	Remediation
Unresolved product id: AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.src	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.x86_64	—	Vendor Fix fix Workaround

Threats

Impact Moderate

CVE-2026-25681

A flaw was found in golang.org/x/net/html. A remote attacker could exploit this vulnerability by providing specially crafted HTML. When this arbitrary HTML is parsed and rendered, it can result in an unexpected HTML tree, bypassing input sanitization. This can be leveraged to execute Cross-Site Scripting (XSS) attacks, potentially leading to arbitrary code execution in applications that use the affected component.

8.1 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected products

Fixed 17 products, the same list as for CVE-2026-8609

Threats

Impact Important

CVE-2026-27136

A flaw was found in golang.org/x/net/html. When arbitrary HTML is parsed and then rendered, it can result in an unexpected HTML tree. This allows an attacker to bypass HTML sanitization mechanisms, leading to Cross-Site Scripting (XSS) attacks in applications. Such attacks can result in information disclosure or arbitrary code execution.

8.1 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected products

Fixed 17 products, the same list as for CVE-2026-8609

Threats

Impact Important

CVE-2026-27137

A certificate validation flaw has been discovered in the golang crypto/x509 module. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-295 - Improper Certificate Validation

Affected products

Fixed 17 products, the same list as for CVE-2026-8609

Threats

Impact Important

CVE-2026-33376

A flaw in Grafana's Auth Proxy IPv6 allow-list incorrectly defaults to a broad /32 subnet mask instead of a strict /128. This misconfiguration allows remote attackers to bypass access restrictions, potentially leading to unauthorized access and data manipulation.

7.4 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

CWE-183 - Permissive List of Allowed Inputs

Affected products

Fixed 17 products, the same list as for CVE-2026-8609

Threats

Impact Moderate

CVE-2026-33377

A flaw was found in Grafana. A user with editor privileges can overwrite a dashboard not owned by them, leading to privilege escalation on that specific dashboard. This allows the editor to gain administrative control over the affected dashboard.

7.1 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

CWE-267 - Privilege Defined With Unsafe Actions

Affected products

Fixed 17 products, the same list as for CVE-2026-8609

Threats

Impact Moderate

CVE-2026-33382

A flaw in Grafana's API endpoints allows remote attackers to send excessively large request bodies without authentication. This exhausts server memory, resulting in a complete denial of service (DoS).

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 17 products, the same list as for CVE-2026-8609

Threats

Impact Moderate

CVE-2026-33810

A flaw was found in the `crypto/x509` package within Go (golang). When verifying a certificate chain, excluded DNS (Domain Name System) constraints are not correctly applied to wildcard DNS Subject Alternative Names (SANs) if the case of the SAN differs from the constraint. This oversight could allow an attacker to bypass certificate validation, potentially leading to the acceptance of a malicious certificate that should have been rejected. This issue specifically impacts the validation of trusted certificate chains.

8.8 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L

CWE-1289 - Improper Validation of Unsafe Equivalence in Input

Affected products

Fixed 17 products, the same list as for CVE-2026-8609

Threats

Impact Important

CVE-2026-33818

A flaw was found in the `encoding/asn1` package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One (ASN.1) structure, leading to excessive recursion during the `Unmarshal` operation. This could result in stack exhaustion and a Denial of Service (DoS) condition.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-776 - Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

Affected products

Fixed 17 products, the same list as for CVE-2026-8609

Threats

Impact Important

CVE-2026-39820

A flaw was found in the `net/mail` package of the Go programming language. An attacker could provide specially crafted inputs to the `ParseAddress`, `ParseAddressList`, or `ParseDate` functions. This could lead to excessive consumption of CPU and memory resources, resulting in a Denial of Service (DoS) for applications processing these inputs.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-606 - Unchecked Input for Loop Condition

Affected products

Fixed 17 products, the same list as for CVE-2026-8609

Threats

Impact Important

CVE-2026-39821

A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname (for example, xn--example-.com returns example.com instead of an error). Applications that validate the ASCII form then convert to Unicode may grant access to a restricted hostname the ASCII check would have rejected.

8.2 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

CWE-1289 - Improper Validation of Unsafe Equivalence in Input

Affected products

Fixed 17 products, the same list as for CVE-2026-8609

Threats

Impact Important

CVE-2026-42127

A flaw was found in Grafana. An unauthenticated attacker can exploit the public dashboard query endpoint by sending arbitrarily large JSON payloads. This vulnerability, caused by a lack of request body size limits, triggers excessive memory allocation, leading to a denial of service through memory exhaustion.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 17 products, the same list as for CVE-2026-8609

Threats

Impact Important

CVE-2026-42499

A flaw was found in the `net/mail` package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the `consumePhrase` function, it can lead to excessive resource consumption due to quadratic string concatenation, resulting in a Denial of Service (DoS) condition.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-1046 - Creation of Immutable Text Using String Concatenation

Affected products

Fixed 17 products, the same list as for CVE-2026-8609

Threats

Impact Important

CVE-2026-42502

A flaw was found in golang.org/x/net/html. This vulnerability allows an attacker to manipulate how HTML is processed and displayed. By providing specially crafted HTML, an attacker can cause an unexpected structure in the rendered output. This can lead to Cross-Site Scripting (XSS) attacks, where malicious scripts are executed in a user's web browser, potentially compromising user data or taking control of their session.

6.1 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected products

Fixed 17 products, the same list as for CVE-2026-8609

Threats

Impact Moderate

CVE-2026-56853

A flaw was found in the `net/http` component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the `ReadHeaderTimeout` is not correctly applied during this process. This oversight could allow a remote attacker to maintain open connections indefinitely, potentially leading to a Denial of Service (DoS) by exhausting server resources.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 17 products, the same list as for CVE-2026-8609

Threats

Impact Important

CVE-2026-56858

A flaw was found in the `html/template` component of Go (golang). Pathological inputs could prematurely close an unescaped forward slash ('/'), allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting (XSS), where malicious scripts are executed in a user's browser, potentially compromising user data or actions.

8.1 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected products

Fixed 17 products, the same list as for CVE-2026-8609

Threats

Impact Important

CVE-2026-56859

A flaw was found in the `encoding/xml` package of Go. The `DecodeElement` function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service (DoS) for the affected application.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-776 - Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

Affected products

Fixed 17 products, the same list as for CVE-2026-8609

Threats

Impact Important

CVE-2026-56860

A flaw was found in `net/url`, a component of `golang`. This vulnerability arises when resolving relative paths that contain numerous parent directory ('..') segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory allocation. This can result in a Denial of Service (DoS) due to resource exhaustion.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 17 products, the same list as for CVE-2026-8609

Threats

Impact Important

CVE-2026-56862

A flaw was found in the `crypto/tls` package, part of `golang`. A malicious client can exploit this vulnerability by continuously sending KeyUpdate messages to a server. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service (DoS) condition.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-1050 - Excessive Platform Resource Consumption within a Loop

Affected products

Fixed 17 products, the same list as for CVE-2026-8609

Threats

Impact Important

References

149 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:67517	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2445345	external
https://bugzilla.redhat.com/show_bug.cgi?id=2456335	external
https://bugzilla.redhat.com/show_bug.cgi?id=2467809	external
https://bugzilla.redhat.com/show_bug.cgi?id=2467820	external
https://bugzilla.redhat.com/show_bug.cgi?id=2477246	external
https://bugzilla.redhat.com/show_bug.cgi?id=2477262	external
https://bugzilla.redhat.com/show_bug.cgi?id=2480756	external
https://bugzilla.redhat.com/show_bug.cgi?id=2480757	external
https://bugzilla.redhat.com/show_bug.cgi?id=2480761	external
https://bugzilla.redhat.com/show_bug.cgi?id=2480762	external
https://bugzilla.redhat.com/show_bug.cgi?id=2499061	external
https://bugzilla.redhat.com/show_bug.cgi?id=2499062	external
https://bugzilla.redhat.com/show_bug.cgi?id=2515815	external
https://bugzilla.redhat.com/show_bug.cgi?id=2515820	external
https://bugzilla.redhat.com/show_bug.cgi?id=2515827	external
https://bugzilla.redhat.com/show_bug.cgi?id=2515838	external
https://bugzilla.redhat.com/show_bug.cgi?id=2515839	external
https://bugzilla.redhat.com/show_bug.cgi?id=2515840	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-8609	self
https://bugzilla.redhat.com/show_bug.cgi?id=2499061	external
https://www.cve.org/CVERecord?id=CVE-2026-8609	external
https://nvd.nist.gov/vuln/detail/CVE-2026-8609	external
https://grafana.com/security/security-advisories/…	external
https://access.redhat.com/security/cve/CVE-2026-25681	self
https://bugzilla.redhat.com/show_bug.cgi?id=2480761	external
https://www.cve.org/CVERecord?id=CVE-2026-25681	external
https://nvd.nist.gov/vuln/detail/CVE-2026-25681	external
https://go.dev/cl/781703	external
https://go.dev/issue/79574	external
https://groups.google.com/g/golang-announce/c/iI-…	external
https://pkg.go.dev/vuln/GO-2026-5029	external
https://access.redhat.com/security/cve/CVE-2026-27136	self
https://bugzilla.redhat.com/show_bug.cgi?id=2480757	external
https://www.cve.org/CVERecord?id=CVE-2026-27136	external
https://nvd.nist.gov/vuln/detail/CVE-2026-27136	external
https://go.dev/cl/781685	external
https://go.dev/issue/79575	external
https://pkg.go.dev/vuln/GO-2026-5030	external
https://access.redhat.com/security/cve/CVE-2026-27137	self
https://bugzilla.redhat.com/show_bug.cgi?id=2445345	external
https://www.cve.org/CVERecord?id=CVE-2026-27137	external
https://nvd.nist.gov/vuln/detail/CVE-2026-27137	external
https://go.dev/cl/752182	external
https://go.dev/issue/77952	external
https://groups.google.com/g/golang-announce/c/Edh…	external
https://pkg.go.dev/vuln/GO-2026-4599	external
https://access.redhat.com/security/cve/CVE-2026-33376	self
https://bugzilla.redhat.com/show_bug.cgi?id=2477262	external
https://www.cve.org/CVERecord?id=CVE-2026-33376	external
https://nvd.nist.gov/vuln/detail/CVE-2026-33376	external
https://grafana.com/security/security-advisories/…	external
https://access.redhat.com/security/cve/CVE-2026-33377	self
https://bugzilla.redhat.com/show_bug.cgi?id=2477246	external
https://www.cve.org/CVERecord?id=CVE-2026-33377	external
https://nvd.nist.gov/vuln/detail/CVE-2026-33377	external
https://grafana.com/security/security-advisories/…	external
https://access.redhat.com/security/cve/CVE-2026-33382	self
https://bugzilla.redhat.com/show_bug.cgi?id=2499062	external
https://www.cve.org/CVERecord?id=CVE-2026-33382	external
https://nvd.nist.gov/vuln/detail/CVE-2026-33382	external
https://grafana.com/security/security-advisories/…	external
https://access.redhat.com/security/cve/CVE-2026-33810	self
https://bugzilla.redhat.com/show_bug.cgi?id=2456335	external
https://www.cve.org/CVERecord?id=CVE-2026-33810	external
https://nvd.nist.gov/vuln/detail/CVE-2026-33810	external
https://go.dev/cl/763763	external
https://go.dev/issue/78332	external
https://groups.google.com/g/golang-announce/c/0uY…	external
https://pkg.go.dev/vuln/GO-2026-4866	external
https://access.redhat.com/security/cve/CVE-2026-33818	self
https://bugzilla.redhat.com/show_bug.cgi?id=2515815	external
https://www.cve.org/CVERecord?id=CVE-2026-33818	external
https://nvd.nist.gov/vuln/detail/CVE-2026-33818	external
https://go.dev/cl/814980	external
https://go.dev/issue/80405	external
https://groups.google.com/g/golang-announce/c/94p…	external
https://pkg.go.dev/vuln/GO-2026-5972	external
https://access.redhat.com/security/cve/CVE-2026-39820	self
https://bugzilla.redhat.com/show_bug.cgi?id=2467820	external
https://www.cve.org/CVERecord?id=CVE-2026-39820	external
https://nvd.nist.gov/vuln/detail/CVE-2026-39820	external
https://go.dev/cl/759940	external
https://go.dev/issue/78566	external
https://groups.google.com/g/golang-announce/c/qcC…	external
https://pkg.go.dev/vuln/GO-2026-4986	external
https://access.redhat.com/security/cve/CVE-2026-39821	self
https://bugzilla.redhat.com/show_bug.cgi?id=2480756	external
https://www.cve.org/CVERecord?id=CVE-2026-39821	external
https://nvd.nist.gov/vuln/detail/CVE-2026-39821	external
https://go.dev/cl/767220	external
https://go.dev/issue/78760	external
https://pkg.go.dev/vuln/GO-2026-5026	external
https://access.redhat.com/security/cve/CVE-2026-42127	self
https://bugzilla.redhat.com/show_bug.cgi?id=2491449	external
https://www.cve.org/CVERecord?id=CVE-2026-42127	external
https://nvd.nist.gov/vuln/detail/CVE-2026-42127	external
https://grafana.com/security/security-advisories/…	external
https://access.redhat.com/security/cve/CVE-2026-42499	self
https://bugzilla.redhat.com/show_bug.cgi?id=2467809	external
https://www.cve.org/CVERecord?id=CVE-2026-42499	external
https://nvd.nist.gov/vuln/detail/CVE-2026-42499	external
https://go.dev/cl/771520	external
https://go.dev/issue/78987	external
https://pkg.go.dev/vuln/GO-2026-4977	external
https://access.redhat.com/security/cve/CVE-2026-42502	self
https://bugzilla.redhat.com/show_bug.cgi?id=2480762	external
https://www.cve.org/CVERecord?id=CVE-2026-42502	external
https://nvd.nist.gov/vuln/detail/CVE-2026-42502	external
https://go.dev/cl/781701	external
https://go.dev/issue/79572	external
https://pkg.go.dev/vuln/GO-2026-5027	external
https://access.redhat.com/security/cve/CVE-2026-56853	self
https://bugzilla.redhat.com/show_bug.cgi?id=2515827	external
https://www.cve.org/CVERecord?id=CVE-2026-56853	external
https://nvd.nist.gov/vuln/detail/CVE-2026-56853	external
https://go.dev/cl/795540	external
https://go.dev/issue/80205	external
https://pkg.go.dev/vuln/GO-2026-6089	external
https://access.redhat.com/security/cve/CVE-2026-56858	self
https://bugzilla.redhat.com/show_bug.cgi?id=2515838	external
https://www.cve.org/CVERecord?id=CVE-2026-56858	external
https://nvd.nist.gov/vuln/detail/CVE-2026-56858	external
https://go.dev/cl/807100	external
https://go.dev/issue/80435	external
https://pkg.go.dev/vuln/GO-2026-6091	external
https://access.redhat.com/security/cve/CVE-2026-56859	self
https://bugzilla.redhat.com/show_bug.cgi?id=2515840	external
https://www.cve.org/CVERecord?id=CVE-2026-56859	external
https://nvd.nist.gov/vuln/detail/CVE-2026-56859	external
https://go.dev/cl/803320	external
https://go.dev/issue/80481	external
https://pkg.go.dev/vuln/GO-2026-6088	external
https://access.redhat.com/security/cve/CVE-2026-56860	self
https://bugzilla.redhat.com/show_bug.cgi?id=2515820	external
https://www.cve.org/CVERecord?id=CVE-2026-56860	external
https://nvd.nist.gov/vuln/detail/CVE-2026-56860	external
https://go.dev/cl/803681	external
https://go.dev/issue/80494	external
https://pkg.go.dev/vuln/GO-2026-6218	external
https://access.redhat.com/security/cve/CVE-2026-56862	self
https://bugzilla.redhat.com/show_bug.cgi?id=2515839	external
https://www.cve.org/CVERecord?id=CVE-2026-56862	external
https://nvd.nist.gov/vuln/detail/CVE-2026-56862	external
https://go.dev/cl/804261	external
https://go.dev/issue/80528	external
https://pkg.go.dev/vuln/GO-2026-6090	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for grafana is now available for Red Hat Enterprise Linux 10.0 Extended Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB \u0026 OpenTSDB. \n\nSecurity Fix(es):\n\n* crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137)\n\n* crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application (CVE-2026-33810)\n\n* net/mail: golang: net/mail: Denial of Service via pathological email address parsing (CVE-2026-42499)\n\n* net/mail: golang: Go net/mail: Denial of Service via crafted email inputs (CVE-2026-39820)\n\n* grafana: Grafana: Privilege escalation via dashboard overwrite (CVE-2026-33377)\n\n* grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default (CVE-2026-33376)\n\n* golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)\n\n* golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136)\n\n* golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681)\n\n* golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering (CVE-2026-42502)\n\n* grafana: Grafana: Denial of Service due to excessive memory allocation via large JSON payloads (CVE-2026-42127)\n\n* grafana: Grafana: Denial of Service via unbounded memory growth in OAuth login route (CVE-2026-8609)\n\n* grafana: Grafana: Denial of Service via excessive memory allocation from large API request payloads (CVE-2026-33382)\n\n* encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)\n\n* net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)\n\n* net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)\n\n* html/template: golang: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)\n\n* crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)\n\n* encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:67517",
        "url": "https://access.redhat.com/errata/RHSA-2026:67517"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2445345",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445345"
      },
      {
        "category": "external",
        "summary": "2456335",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456335"
      },
      {
        "category": "external",
        "summary": "2467809",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467809"
      },
      {
        "category": "external",
        "summary": "2467820",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467820"
      },
      {
        "category": "external",
        "summary": "2477246",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477246"
      },
      {
        "category": "external",
        "summary": "2477262",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477262"
      },
      {
        "category": "external",
        "summary": "2480756",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480756"
      },
      {
        "category": "external",
        "summary": "2480757",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480757"
      },
      {
        "category": "external",
        "summary": "2480761",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480761"
      },
      {
        "category": "external",
        "summary": "2480762",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480762"
      },
      {
        "category": "external",
        "summary": "2499061",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499061"
      },
      {
        "category": "external",
        "summary": "2499062",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499062"
      },
      {
        "category": "external",
        "summary": "2515815",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515815"
      },
      {
        "category": "external",
        "summary": "2515820",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515820"
      },
      {
        "category": "external",
        "summary": "2515827",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515827"
      },
      {
        "category": "external",
        "summary": "2515838",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515838"
      },
      {
        "category": "external",
        "summary": "2515839",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515839"
      },
      {
        "category": "external",
        "summary": "2515840",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515840"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_67517.json"
      }
    ],
    "title": "Red Hat Security Advisory: grafana security update",
    "tracking": {
      "current_release_date": "2026-09-16T10:52:37+00:00",
      "generator": {
        "date": "2026-09-16T10:52:37+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.21"
        }
      },
      "id": "RHSA-2026:67517",
      "initial_release_date": "2026-09-15T10:06:12+00:00",
      "revision_history": [
        {
          "date": "2026-09-15T10:06:12+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-09-15T10:06:12+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-09-16T10:52:37+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
                  "product_id": "AppStream-10.0.Z.E2S",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux_eus:10.0"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana-0:10.2.6-26.el10_0.src",
                "product": {
                  "name": "grafana-0:10.2.6-26.el10_0.src",
                  "product_id": "grafana-0:10.2.6-26.el10_0.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana@10.2.6-26.el10_0?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana-0:10.2.6-26.el10_0.aarch64",
                "product": {
                  "name": "grafana-0:10.2.6-26.el10_0.aarch64",
                  "product_id": "grafana-0:10.2.6-26.el10_0.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana@10.2.6-26.el10_0?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-selinux-0:10.2.6-26.el10_0.aarch64",
                "product": {
                  "name": "grafana-selinux-0:10.2.6-26.el10_0.aarch64",
                  "product_id": "grafana-selinux-0:10.2.6-26.el10_0.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-selinux@10.2.6-26.el10_0?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-debugsource-0:10.2.6-26.el10_0.aarch64",
                "product": {
                  "name": "grafana-debugsource-0:10.2.6-26.el10_0.aarch64",
                  "product_id": "grafana-debugsource-0:10.2.6-26.el10_0.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-debugsource@10.2.6-26.el10_0?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-debuginfo-0:10.2.6-26.el10_0.aarch64",
                "product": {
                  "name": "grafana-debuginfo-0:10.2.6-26.el10_0.aarch64",
                  "product_id": "grafana-debuginfo-0:10.2.6-26.el10_0.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-debuginfo@10.2.6-26.el10_0?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana-0:10.2.6-26.el10_0.ppc64le",
                "product": {
                  "name": "grafana-0:10.2.6-26.el10_0.ppc64le",
                  "product_id": "grafana-0:10.2.6-26.el10_0.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana@10.2.6-26.el10_0?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-selinux-0:10.2.6-26.el10_0.ppc64le",
                "product": {
                  "name": "grafana-selinux-0:10.2.6-26.el10_0.ppc64le",
                  "product_id": "grafana-selinux-0:10.2.6-26.el10_0.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-selinux@10.2.6-26.el10_0?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-debugsource-0:10.2.6-26.el10_0.ppc64le",
                "product": {
                  "name": "grafana-debugsource-0:10.2.6-26.el10_0.ppc64le",
                  "product_id": "grafana-debugsource-0:10.2.6-26.el10_0.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-debugsource@10.2.6-26.el10_0?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-debuginfo-0:10.2.6-26.el10_0.ppc64le",
                "product": {
                  "name": "grafana-debuginfo-0:10.2.6-26.el10_0.ppc64le",
                  "product_id": "grafana-debuginfo-0:10.2.6-26.el10_0.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-debuginfo@10.2.6-26.el10_0?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana-0:10.2.6-26.el10_0.s390x",
                "product": {
                  "name": "grafana-0:10.2.6-26.el10_0.s390x",
                  "product_id": "grafana-0:10.2.6-26.el10_0.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana@10.2.6-26.el10_0?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-selinux-0:10.2.6-26.el10_0.s390x",
                "product": {
                  "name": "grafana-selinux-0:10.2.6-26.el10_0.s390x",
                  "product_id": "grafana-selinux-0:10.2.6-26.el10_0.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-selinux@10.2.6-26.el10_0?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-debugsource-0:10.2.6-26.el10_0.s390x",
                "product": {
                  "name": "grafana-debugsource-0:10.2.6-26.el10_0.s390x",
                  "product_id": "grafana-debugsource-0:10.2.6-26.el10_0.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-debugsource@10.2.6-26.el10_0?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-debuginfo-0:10.2.6-26.el10_0.s390x",
                "product": {
                  "name": "grafana-debuginfo-0:10.2.6-26.el10_0.s390x",
                  "product_id": "grafana-debuginfo-0:10.2.6-26.el10_0.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-debuginfo@10.2.6-26.el10_0?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana-0:10.2.6-26.el10_0.x86_64",
                "product": {
                  "name": "grafana-0:10.2.6-26.el10_0.x86_64",
                  "product_id": "grafana-0:10.2.6-26.el10_0.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana@10.2.6-26.el10_0?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-selinux-0:10.2.6-26.el10_0.x86_64",
                "product": {
                  "name": "grafana-selinux-0:10.2.6-26.el10_0.x86_64",
                  "product_id": "grafana-selinux-0:10.2.6-26.el10_0.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-selinux@10.2.6-26.el10_0?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-debugsource-0:10.2.6-26.el10_0.x86_64",
                "product": {
                  "name": "grafana-debugsource-0:10.2.6-26.el10_0.x86_64",
                  "product_id": "grafana-debugsource-0:10.2.6-26.el10_0.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-debugsource@10.2.6-26.el10_0?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "grafana-debuginfo-0:10.2.6-26.el10_0.x86_64",
                "product": {
                  "name": "grafana-debuginfo-0:10.2.6-26.el10_0.x86_64",
                  "product_id": "grafana-debuginfo-0:10.2.6-26.el10_0.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana-debuginfo@10.2.6-26.el10_0?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-0:10.2.6-26.el10_0.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.aarch64"
        },
        "product_reference": "grafana-0:10.2.6-26.el10_0.aarch64",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-0:10.2.6-26.el10_0.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.ppc64le"
        },
        "product_reference": "grafana-0:10.2.6-26.el10_0.ppc64le",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-0:10.2.6-26.el10_0.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.s390x"
        },
        "product_reference": "grafana-0:10.2.6-26.el10_0.s390x",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-0:10.2.6-26.el10_0.src as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.src"
        },
        "product_reference": "grafana-0:10.2.6-26.el10_0.src",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-0:10.2.6-26.el10_0.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.x86_64"
        },
        "product_reference": "grafana-0:10.2.6-26.el10_0.x86_64",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-debuginfo-0:10.2.6-26.el10_0.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.aarch64"
        },
        "product_reference": "grafana-debuginfo-0:10.2.6-26.el10_0.aarch64",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-debuginfo-0:10.2.6-26.el10_0.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.ppc64le"
        },
        "product_reference": "grafana-debuginfo-0:10.2.6-26.el10_0.ppc64le",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-debuginfo-0:10.2.6-26.el10_0.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.s390x"
        },
        "product_reference": "grafana-debuginfo-0:10.2.6-26.el10_0.s390x",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-debuginfo-0:10.2.6-26.el10_0.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.x86_64"
        },
        "product_reference": "grafana-debuginfo-0:10.2.6-26.el10_0.x86_64",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-debugsource-0:10.2.6-26.el10_0.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.aarch64"
        },
        "product_reference": "grafana-debugsource-0:10.2.6-26.el10_0.aarch64",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-debugsource-0:10.2.6-26.el10_0.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.ppc64le"
        },
        "product_reference": "grafana-debugsource-0:10.2.6-26.el10_0.ppc64le",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-debugsource-0:10.2.6-26.el10_0.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.s390x"
        },
        "product_reference": "grafana-debugsource-0:10.2.6-26.el10_0.s390x",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-debugsource-0:10.2.6-26.el10_0.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.x86_64"
        },
        "product_reference": "grafana-debugsource-0:10.2.6-26.el10_0.x86_64",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-selinux-0:10.2.6-26.el10_0.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.aarch64"
        },
        "product_reference": "grafana-selinux-0:10.2.6-26.el10_0.aarch64",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-selinux-0:10.2.6-26.el10_0.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.ppc64le"
        },
        "product_reference": "grafana-selinux-0:10.2.6-26.el10_0.ppc64le",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-selinux-0:10.2.6-26.el10_0.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.s390x"
        },
        "product_reference": "grafana-selinux-0:10.2.6-26.el10_0.s390x",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana-selinux-0:10.2.6-26.el10_0.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v. 10.0)",
          "product_id": "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.x86_64"
        },
        "product_reference": "grafana-selinux-0:10.2.6-26.el10_0.x86_64",
        "relates_to_product_reference": "AppStream-10.0.Z.E2S"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-8609",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-07-10T16:01:49.522746+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2499061"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Grafana. An unauthenticated attacker can repeatedly access the OAuth login route with unique values. This can lead to unbounded memory growth, eventually exhausting system memory and causing the Grafana instance to crash. This results in a denial of service for legitimate users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "grafana: Grafana: Denial of Service via unbounded memory growth in OAuth login route",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The flaw in Grafana is rated Moderate, as an unauthenticated attacker can trigger a denial of service by repeatedly accessing the OAuth login route, leading to unbounded memory growth and instance crashes.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.s390x",
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.src",
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.s390x",
          "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.s390x",
          "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.s390x",
          "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-8609"
        },
        {
          "category": "external",
          "summary": "RHBZ#2499061",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499061"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-8609",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-8609"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-8609",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8609"
        },
        {
          "category": "external",
          "summary": "https://grafana.com/security/security-advisories/cve-2026-8609",
          "url": "https://grafana.com/security/security-advisories/cve-2026-8609"
        }
      ],
      "release_date": "2026-07-10T14:58:33.522000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-15T10:06:12+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.src",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:67517"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, restrict network access to the Grafana instance to trusted internal networks or localhost. If a reverse proxy or load balancer is deployed in front of Grafana, configure it to implement rate limiting on requests to the OAuth login endpoint to prevent an attacker from exhausting system resources. If OAuth is not required, consider disabling it in the Grafana configuration, though this may impact user authentication workflows.",
          "product_ids": [
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.src",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.src",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "grafana: Grafana: Denial of Service via unbounded memory growth in OAuth login route"
    },
    {
      "cve": "CVE-2026-25681",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2026-05-22T16:01:08.177603+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2480761"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in golang.org/x/net/html. A remote attacker could exploit this vulnerability by providing specially crafted HTML. When this arbitrary HTML is parsed and rendered, it can result in an unexpected HTML tree, bypassing input sanitization. This can be leveraged to execute Cross-Site Scripting (XSS) attacks, potentially leading to arbitrary code execution in applications that use the affected component.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important vulnerability in `golang.org/x/net/html` could enable remote attackers to execute Cross-Site Scripting (XSS) attacks, potentially leading to arbitrary code execution. The flaw allows specially crafted HTML to bypass input sanitization during parsing and rendering. Red Hat products are affected if they process untrusted HTML content using the vulnerable component without additional output encoding or robust content security policies.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.s390x",
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.src",
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.s390x",
          "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.s390x",
          "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.s390x",
          "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-25681"
        },
        {
          "category": "external",
          "summary": "RHBZ#2480761",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480761"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-25681",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-25681"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25681",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25681"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/781703",
          "url": "https://go.dev/cl/781703"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/79574",
          "url": "https://go.dev/issue/79574"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8",
          "url": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-5029",
          "url": "https://pkg.go.dev/vuln/GO-2026-5029"
        }
      ],
      "release_date": "2026-05-22T15:01:21.975000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-15T10:06:12+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.src",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:67517"
        },
        {
          "category": "workaround",
          "details": "To mitigate this flaw, applications processing untrusted HTML input must implement strict input sanitization and ensure all output is properly encoded before rendering. Deploying a comprehensive Content Security Policy (CSP) can restrict script execution, further reducing the attack surface. Administrators should review application configurations to ensure adequate protection against XSS.",
          "product_ids": [
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.src",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.src",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting"
    },
    {
      "cve": "CVE-2026-27136",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2026-05-22T16:00:56.609820+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2480757"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in golang.org/x/net/html. When arbitrary HTML is parsed and then rendered, it can result in an unexpected HTML tree. This allows an attacker to bypass HTML sanitization mechanisms, leading to Cross-Site Scripting (XSS) attacks in applications. Such attacks can result in information disclosure or arbitrary code execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability in `golang.org/x/net/html` is rated as Important. It allows for Cross-Site Scripting (XSS) attacks by enabling an attacker to bypass HTML sanitization mechanisms when arbitrary HTML is parsed and rendered. This can lead to information disclosure or arbitrary code execution in affected applications. Exploitation typically requires user interaction, where a user processes specially crafted malicious HTML content.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.s390x",
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.src",
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.s390x",
          "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.s390x",
          "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.s390x",
          "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-27136"
        },
        {
          "category": "external",
          "summary": "RHBZ#2480757",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480757"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-27136",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-27136"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27136",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27136"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/781685",
          "url": "https://go.dev/cl/781685"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/79575",
          "url": "https://go.dev/issue/79575"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8",
          "url": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-5030",
          "url": "https://pkg.go.dev/vuln/GO-2026-5030"
        }
      ],
      "release_date": "2026-05-22T15:01:22.111000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-15T10:06:12+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.src",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:67517"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.src",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.src",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass"
    },
    {
      "cve": "CVE-2026-27137",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "discovery_date": "2026-03-06T22:01:38.859733+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2445345"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A certificate validation flaw has been discovered in the golang crypto/x509 module. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "crypto/x509: Incorrect enforcement of email constraints in crypto/x509",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.s390x",
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.src",
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.s390x",
          "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.s390x",
          "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.s390x",
          "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-27137"
        },
        {
          "category": "external",
          "summary": "RHBZ#2445345",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445345"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-27137",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-27137"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27137",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27137"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/752182",
          "url": "https://go.dev/cl/752182"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/77952",
          "url": "https://go.dev/issue/77952"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk",
          "url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4599",
          "url": "https://pkg.go.dev/vuln/GO-2026-4599"
        }
      ],
      "release_date": "2026-03-06T21:28:13.748000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-15T10:06:12+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.src",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:67517"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.src",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.src",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "crypto/x509: Incorrect enforcement of email constraints in crypto/x509"
    },
    {
      "cve": "CVE-2026-33376",
      "cwe": {
        "id": "CWE-183",
        "name": "Permissive List of Allowed Inputs"
      },
      "discovery_date": "2026-05-13T20:02:51.602978+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2477262"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw in Grafana\u0027s Auth Proxy IPv6 allow-list incorrectly defaults to a broad /32 subnet mask instead of a strict /128. This misconfiguration allows remote attackers to bypass access restrictions, potentially leading to unauthorized access and data manipulation.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw in Grafana\u0027s Auth Proxy IPv6 allow-list defaults to an overly broad /32 mask, potentially allowing unauthorized access. This strictly affects Auth Proxy deployments using IPv6 allow-lists; other authentication methods are unaffected. This has been rated moderate since auth proxy authentication is not enabled by default on grafana shipped on RHEL.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.s390x",
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.src",
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.s390x",
          "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.s390x",
          "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.s390x",
          "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-33376"
        },
        {
          "category": "external",
          "summary": "RHBZ#2477262",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477262"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-33376",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-33376"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33376",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33376"
        },
        {
          "category": "external",
          "summary": "https://grafana.com/security/security-advisories/cve-2026-33376",
          "url": "https://grafana.com/security/security-advisories/cve-2026-33376"
        }
      ],
      "release_date": "2026-05-13T19:28:34.473000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-15T10:06:12+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.src",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:67517"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, explicitly specify the intended IPv6 address mask\u2014typically /128 for a single host\u2014within the Grafana Auth Proxy allow-list configuration. This overrides the incorrect default /32 mask, ensuring that network access restrictions are applied strictly as intended.\nFor RHEL: Update the whitelist directive under the [auth.proxy] section in /etc/grafana/grafana.ini. For example, if ::1 is the desired address, configure it explicitly as ::1/128. A restart of the Grafana service (systemctl restart grafana-server) is required for the changes to take effect.",
          "product_ids": [
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.src",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.src",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default"
    },
    {
      "cve": "CVE-2026-33377",
      "cwe": {
        "id": "CWE-267",
        "name": "Privilege Defined With Unsafe Actions"
      },
      "discovery_date": "2026-05-13T20:02:01.027996+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2477246"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Grafana. A user with editor privileges can overwrite a dashboard not owned by them, leading to privilege escalation on that specific dashboard. This allows the editor to gain administrative control over the affected dashboard.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "grafana: Grafana: Privilege escalation via dashboard overwrite",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A privilege escalation flaw exists in Grafana, allowing an authenticated editor with write access to a dashboard to overwrite other dashboards not owned by them. This grants the editor administrative control over the targeted dashboard, potentially leading to unauthorized data manipulation or exposure within the Grafana environment.\n\nRed Hat\u0027s default deployment does not grant edit access to normal users. Hence, this is rated moderate.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.s390x",
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.src",
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.s390x",
          "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.s390x",
          "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.s390x",
          "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-33377"
        },
        {
          "category": "external",
          "summary": "RHBZ#2477246",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477246"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-33377",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-33377"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33377",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33377"
        },
        {
          "category": "external",
          "summary": "https://grafana.com/security/security-advisories/cve-2026-33377",
          "url": "https://grafana.com/security/security-advisories/cve-2026-33377"
        }
      ],
      "release_date": "2026-05-13T19:28:28.154000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-15T10:06:12+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.src",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:67517"
        },
        {
          "category": "workaround",
          "details": "Audit dashboard-level permissions to ensure that write access is granted only to users who should be able to modify each specific dashboard. Revoke per-dashboard write permissions from Editor users who do not strictly require them.",
          "product_ids": [
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.src",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.src",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "grafana: Grafana: Privilege escalation via dashboard overwrite"
    },
    {
      "cve": "CVE-2026-33382",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-07-10T16:01:52.612017+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2499062"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw in Grafana\u0027s API endpoints allows remote attackers to send excessively large request bodies without authentication. This exhausts server memory, resulting in a complete denial of service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "grafana: Grafana: Denial of Service via excessive memory allocation from large API request payloads",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Moderate: This denial of service vulnerability in Grafana stems from a lack of request body size limits on certain API endpoints, some of which are unauthenticated. Exploitation by a remote attacker sending large payloads can exhaust system memory, leading to service unavailability. The impact is assessed as Moderate because it primarily affects the availability of the Grafana application rather than compromising data or executing arbitrary code.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.s390x",
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.src",
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.s390x",
          "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.s390x",
          "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.s390x",
          "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-33382"
        },
        {
          "category": "external",
          "summary": "RHBZ#2499062",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499062"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-33382",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-33382"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33382",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33382"
        },
        {
          "category": "external",
          "summary": "https://grafana.com/security/security-advisories/cve-2026-33382",
          "url": "https://grafana.com/security/security-advisories/cve-2026-33382"
        }
      ],
      "release_date": "2026-07-10T14:58:23.329000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-15T10:06:12+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.src",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:67517"
        },
        {
          "category": "workaround",
          "details": "Deploy a reverse proxy or API gateway (e.g., Nginx) in front of Grafana configured to strictly limit the maximum HTTP request body size, dropping oversized payloads before they reach the backend. As a defense-in-depth measure, restrict network access to trusted internal clients via firewall rules. Note: Applying these proxy and network changes may require a service reload, causing a temporary interruption.",
          "product_ids": [
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.src",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.src",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "grafana: Grafana: Denial of Service via excessive memory allocation from large API request payloads"
    },
    {
      "cve": "CVE-2026-33810",
      "cwe": {
        "id": "CWE-1289",
        "name": "Improper Validation of Unsafe Equivalence in Input"
      },
      "discovery_date": "2026-04-08T02:01:09.100830+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2456335"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `crypto/x509` package within Go (golang). When verifying a certificate chain, excluded DNS (Domain Name System) constraints are not correctly applied to wildcard DNS Subject Alternative Names (SANs) if the case of the SAN differs from the constraint. This oversight could allow an attacker to bypass certificate validation, potentially leading to the acceptance of a malicious certificate that should have been rejected. This issue specifically impacts the validation of trusted certificate chains.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important flaw in the Go `crypto/x509` package that could allow an attacker to bypass certificate validation. The vulnerability arises from an incorrect application of excluded DNS constraints to wildcard DNS Subject Alternative Names (SANs) when their case differs from the constraint. This could lead to Red Hat products accepting malicious certificates from otherwise trusted chains, compromising the trust model.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.s390x",
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.src",
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.s390x",
          "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.s390x",
          "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.s390x",
          "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-33810"
        },
        {
          "category": "external",
          "summary": "RHBZ#2456335",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456335"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-33810",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-33810"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33810",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33810"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/763763",
          "url": "https://go.dev/cl/763763"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/78332",
          "url": "https://go.dev/issue/78332"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
          "url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4866",
          "url": "https://pkg.go.dev/vuln/GO-2026-4866"
        }
      ],
      "release_date": "2026-04-08T01:06:56.546000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-15T10:06:12+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.src",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:67517"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.src",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application"
    },
    {
      "cve": "CVE-2026-33818",
      "cwe": {
        "id": "CWE-776",
        "name": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)"
      },
      "discovery_date": "2026-08-13T22:12:37.151735+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2515815"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `encoding/asn1` package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One (ASN.1) structure, leading to excessive recursion during the `Unmarshal` operation. This could result in stack exhaustion and a Denial of Service (DoS) condition.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service flaw in the Go encoding/asn1 package, as it can be triggered remotely without authentication. An attacker can provide a malformed ASN.1 structure, causing excessive recursion during unmarshalling and leading to stack exhaustion, which can render the service unavailable.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.s390x",
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.src",
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.s390x",
          "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.s390x",
          "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.s390x",
          "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-33818"
        },
        {
          "category": "external",
          "summary": "RHBZ#2515815",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515815"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-33818",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-33818"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33818",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33818"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/814980",
          "url": "https://go.dev/cl/814980"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80405",
          "url": "https://go.dev/issue/80405"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI",
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-5972",
          "url": "https://pkg.go.dev/vuln/GO-2026-5972"
        }
      ],
      "release_date": "2026-08-13T21:58:52.821000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-15T10:06:12+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.src",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:67517"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.src",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal"
    },
    {
      "cve": "CVE-2026-39820",
      "cwe": {
        "id": "CWE-606",
        "name": "Unchecked Input for Loop Condition"
      },
      "discovery_date": "2026-05-07T20:01:27.800929+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2467820"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `net/mail` package of the Go programming language. An attacker could provide specially crafted inputs to the `ParseAddress`, `ParseAddressList`, or `ParseDate` functions. This could lead to excessive consumption of CPU and memory resources, resulting in a Denial of Service (DoS) for applications processing these inputs.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net/mail: golang: Go net/mail: Denial of Service via crafted email inputs",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service vulnerability in the Go `net/mail` package. Applications processing untrusted email inputs via `ParseAddress`, `ParseAddressList`, or `ParseDate` functions are susceptible to excessive resource consumption, which can lead to service unavailability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.s390x",
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.src",
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.s390x",
          "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.s390x",
          "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.s390x",
          "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-39820"
        },
        {
          "category": "external",
          "summary": "RHBZ#2467820",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467820"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-39820",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-39820"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39820",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39820"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/759940",
          "url": "https://go.dev/cl/759940"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/78566",
          "url": "https://go.dev/issue/78566"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
          "url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4986",
          "url": "https://pkg.go.dev/vuln/GO-2026-4986"
        }
      ],
      "release_date": "2026-05-07T19:41:19.854000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-15T10:06:12+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.src",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:67517"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.src",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.src",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "net/mail: golang: Go net/mail: Denial of Service via crafted email inputs"
    },
    {
      "cve": "CVE-2026-39821",
      "cwe": {
        "id": "CWE-1289",
        "name": "Improper Validation of Unsafe Equivalence in Input"
      },
      "discovery_date": "2026-05-22T16:00:52.844126+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2480756"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname (for example, xn--example-.com returns example.com instead of an error). Applications that validate the ASCII form then convert to Unicode may grant access to a restricted hostname the ASCII check would have rejected.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "golang.org/x/net/idna is vulnerable to privilege escalation through incorrect Punycode label handling in ToASCII and ToUnicode. An attacker who can supply a Punycode hostname that passes an ASCII-only authorization check may have it normalized to a restricted ASCII name the application intended to block. Red Hat exposure is broad across products shipping the Go toolchain or bundling golang.org/x/net, including RHEL and RHEL-AI golang RPMs, hummingbird Go runtimes, OpenShift and ODF container builds, and Ceph/OpenShift components compiled against affected x/net versions.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.s390x",
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.src",
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.s390x",
          "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.s390x",
          "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.s390x",
          "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-39821"
        },
        {
          "category": "external",
          "summary": "RHBZ#2480756",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480756"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-39821",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-39821"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39821",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39821"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/767220",
          "url": "https://go.dev/cl/767220"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/78760",
          "url": "https://go.dev/issue/78760"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8",
          "url": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-5026",
          "url": "https://pkg.go.dev/vuln/GO-2026-5026"
        }
      ],
      "release_date": "2026-05-22T15:01:21.462000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-15T10:06:12+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.src",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:67517"
        },
        {
          "category": "workaround",
          "details": "Upgrade to a fixed golang.org/x/net release that includes the idna correction, via updated golang or dependent package rebuilds.",
          "product_ids": [
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.src",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.src",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing"
    },
    {
      "cve": "CVE-2026-42127",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-06-22T18:01:38.336979+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2491449"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Grafana. An unauthenticated attacker can exploit the public dashboard query endpoint by sending arbitrarily large JSON payloads. This vulnerability, caused by a lack of request body size limits, triggers excessive memory allocation, leading to a denial of service through memory exhaustion.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "grafana: Grafana: Denial of Service due to excessive memory allocation via large JSON payloads",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service vulnerability in Grafana, affecting Red Hat products that include Grafana. Unauthenticated remote attackers can exploit the public dashboard query endpoint by sending large JSON payloads, leading to excessive memory allocation and potential service disruption. The absence of authentication requirements for exploitation increases the risk of widespread impact.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.s390x",
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.src",
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.s390x",
          "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.s390x",
          "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.s390x",
          "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-42127"
        },
        {
          "category": "external",
          "summary": "RHBZ#2491449",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491449"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-42127",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42127"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42127",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42127"
        },
        {
          "category": "external",
          "summary": "https://grafana.com/security/security-advisories/cve-2026-42127",
          "url": "https://grafana.com/security/security-advisories/cve-2026-42127"
        }
      ],
      "release_date": "2026-06-22T16:31:28.096000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-15T10:06:12+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.src",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:67517"
        },
        {
          "category": "workaround",
          "details": "Restrict network access to the Grafana instance to only trusted clients and networks. This can be achieved by configuring firewall rules to limit inbound connections to the Grafana service port. If Grafana is exposed via a reverse proxy, ensure the proxy is configured to limit request body sizes to prevent large payloads from reaching Grafana. A service restart may be required for network configuration changes to take effect.",
          "product_ids": [
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.src",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.src",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "grafana: Grafana: Denial of Service due to excessive memory allocation via large JSON payloads"
    },
    {
      "cve": "CVE-2026-42499",
      "cwe": {
        "id": "CWE-1046",
        "name": "Creation of Immutable Text Using String Concatenation"
      },
      "discovery_date": "2026-05-07T20:00:51.685602+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2467809"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `net/mail` package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the `consumePhrase` function, it can lead to excessive resource consumption due to quadratic string concatenation, resulting in a Denial of Service (DoS) condition.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net/mail: golang: net/mail: Denial of Service via pathological email address parsing",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service vulnerability in the `net/mail` package of the Go standard library. A remote attacker can exploit this flaw by sending specially crafted email addresses, leading to excessive resource consumption and a denial of service in Go applications that parse email addresses using the affected library.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.s390x",
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.src",
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.s390x",
          "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.s390x",
          "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.s390x",
          "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-42499"
        },
        {
          "category": "external",
          "summary": "RHBZ#2467809",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467809"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-42499",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42499"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42499",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42499"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/771520",
          "url": "https://go.dev/cl/771520"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/78987",
          "url": "https://go.dev/issue/78987"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
          "url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4977",
          "url": "https://pkg.go.dev/vuln/GO-2026-4977"
        }
      ],
      "release_date": "2026-05-07T19:41:18.615000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-15T10:06:12+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.src",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:67517"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.src",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.src",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "net/mail: golang: net/mail: Denial of Service via pathological email address parsing"
    },
    {
      "cve": "CVE-2026-42502",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2026-05-22T16:01:11.151484+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2480762"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in golang.org/x/net/html. This vulnerability allows an attacker to manipulate how HTML is processed and displayed. By providing specially crafted HTML, an attacker can cause an unexpected structure in the rendered output. This can lead to Cross-Site Scripting (XSS) attacks, where malicious scripts are executed in a user\u0027s web browser, potentially compromising user data or taking control of their session.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw in golang.org/x/net/html can lead to Cross-Site Scripting (XSS) in applications that parse and render untrusted HTML, even with sanitization attempts. This is due to an unexpected HTML tree structure, allowing malicious scripts to execute in a user\u0027s browser.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.s390x",
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.src",
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.s390x",
          "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.s390x",
          "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.s390x",
          "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-42502"
        },
        {
          "category": "external",
          "summary": "RHBZ#2480762",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480762"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-42502",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42502"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42502",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42502"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/781701",
          "url": "https://go.dev/cl/781701"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/79572",
          "url": "https://go.dev/issue/79572"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8",
          "url": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-5027",
          "url": "https://pkg.go.dev/vuln/GO-2026-5027"
        }
      ],
      "release_date": "2026-05-22T15:01:21.649000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-15T10:06:12+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.src",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:67517"
        },
        {
          "category": "workaround",
          "details": "Applications utilizing `golang.org/x/net/html` should implement robust sanitization of all untrusted HTML input before rendering to prevent the creation of unexpected HTML structures that could facilitate XSS attacks. If an application does not require rendering arbitrary HTML, it should avoid processing such input.",
          "product_ids": [
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.src",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.src",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering"
    },
    {
      "cve": "CVE-2026-56853",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-08-13T22:14:53.561638+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2515827"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `net/http` component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the `ReadHeaderTimeout` is not correctly applied during this process. This oversight could allow a remote attacker to maintain open connections indefinitely, potentially leading to a Denial of Service (DoS) by exhausting server resources.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Important: Unencrypted HTTP/2 servers are susceptible to a denial of service due to improper handling of ReadHeaderTimeout during the client preface reading phase. This can lead to resource exhaustion and service unavailability in affected Red Hat products configured to support unencrypted HTTP/2.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.s390x",
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.src",
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.s390x",
          "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.s390x",
          "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.s390x",
          "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56853"
        },
        {
          "category": "external",
          "summary": "RHBZ#2515827",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515827"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56853",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56853"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56853",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56853"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/795540",
          "url": "https://go.dev/cl/795540"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80205",
          "url": "https://go.dev/issue/80205"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI",
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6089",
          "url": "https://pkg.go.dev/vuln/GO-2026-6089"
        }
      ],
      "release_date": "2026-08-13T21:58:53.092000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-15T10:06:12+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.src",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:67517"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.src",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service"
    },
    {
      "cve": "CVE-2026-56858",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2026-08-13T22:16:32.034590+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2515838"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `html/template` component of Go (golang). Pathological inputs could prematurely close an unescaped forward slash (\u0027/\u0027), allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting (XSS), where malicious scripts are executed in a user\u0027s browser, potentially compromising user data or actions.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "html/template: golang: Go html/template: Cross-Site Scripting via pathological input",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important cross-site scripting (XSS) vulnerability in the Go `html/template` package. Applications utilizing this package to render untrusted input are susceptible to arbitrary content injection due to a flaw in how pathological inputs are handled, potentially leading to client-side script execution.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.s390x",
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.src",
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.s390x",
          "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.s390x",
          "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.s390x",
          "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56858"
        },
        {
          "category": "external",
          "summary": "RHBZ#2515838",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515838"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56858",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56858"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56858",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56858"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/807100",
          "url": "https://go.dev/cl/807100"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80435",
          "url": "https://go.dev/issue/80435"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI",
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6091",
          "url": "https://pkg.go.dev/vuln/GO-2026-6091"
        }
      ],
      "release_date": "2026-08-13T21:58:53.354000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-15T10:06:12+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.src",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:67517"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.src",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "html/template: golang: Go html/template: Cross-Site Scripting via pathological input"
    },
    {
      "cve": "CVE-2026-56859",
      "cwe": {
        "id": "CWE-776",
        "name": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)"
      },
      "discovery_date": "2026-08-13T22:16:52.493058+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2515840"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `encoding/xml` package of Go. The `DecodeElement` function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service (DoS) for the affected application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "An Important denial of service flaw affects applications utilizing the Go `encoding/xml` package. This vulnerability arises from an issue in XML decoding where a recursion depth counter fails to reset, potentially leading to stack exhaustion when processing malicious XML input.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.s390x",
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.src",
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.s390x",
          "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.s390x",
          "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.s390x",
          "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56859"
        },
        {
          "category": "external",
          "summary": "RHBZ#2515840",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515840"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56859",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56859"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56859",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56859"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/803320",
          "url": "https://go.dev/cl/803320"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80481",
          "url": "https://go.dev/issue/80481"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI",
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6088",
          "url": "https://pkg.go.dev/vuln/GO-2026-6088"
        }
      ],
      "release_date": "2026-08-13T21:58:52.959000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-15T10:06:12+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.src",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:67517"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.src",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.src",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue"
    },
    {
      "cve": "CVE-2026-56860",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-08-13T22:13:18.319384+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2515820"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in `net/url`, a component of `golang`. This vulnerability arises when resolving relative paths that contain numerous parent directory (\u0027..\u0027) segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory allocation. This can result in a Denial of Service (DoS) due to resource exhaustion.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service flaw in the Go `net/url` package. Applications built with Go that process untrusted URLs containing parent directory segments (\u0027..\u0027) may be vulnerable to excessive resource consumption due to quadratic time complexity in path resolution. This can lead to a denial of service, impacting the availability of affected services.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.s390x",
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.src",
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.s390x",
          "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.s390x",
          "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.s390x",
          "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56860"
        },
        {
          "category": "external",
          "summary": "RHBZ#2515820",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515820"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56860",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56860"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56860",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56860"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/803681",
          "url": "https://go.dev/cl/803681"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80494",
          "url": "https://go.dev/issue/80494"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI",
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6218",
          "url": "https://pkg.go.dev/vuln/GO-2026-6218"
        }
      ],
      "release_date": "2026-08-13T21:58:53.731000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-15T10:06:12+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.src",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:67517"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.src",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution"
    },
    {
      "cve": "CVE-2026-56862",
      "cwe": {
        "id": "CWE-1050",
        "name": "Excessive Platform Resource Consumption within a Loop"
      },
      "discovery_date": "2026-08-13T22:16:41.928450+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2515839"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `crypto/tls` package, part of `golang`. A malicious client can exploit this vulnerability by continuously sending KeyUpdate messages to a server. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service (DoS) condition.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service vulnerability in the `golang` `crypto/tls` package. A remote, unauthenticated attacker can exploit this flaw by continuously sending `KeyUpdate` messages during a TLS handshake, forcing the server to perform indefinite key derivation operations. This resource exhaustion can lead to a denial of service for applications and services in Red Hat products that use the affected `crypto/tls` library and are exposed to untrusted network clients.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.s390x",
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.src",
          "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.s390x",
          "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.s390x",
          "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.x86_64",
          "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.aarch64",
          "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.ppc64le",
          "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.s390x",
          "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56862"
        },
        {
          "category": "external",
          "summary": "RHBZ#2515839",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515839"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56862",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56862"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56862",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56862"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/804261",
          "url": "https://go.dev/cl/804261"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80528",
          "url": "https://go.dev/issue/80528"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI",
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6090",
          "url": "https://pkg.go.dev/vuln/GO-2026-6090"
        }
      ],
      "release_date": "2026-08-13T21:58:53.216000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-15T10:06:12+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.src",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:67517"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.src",
            "AppStream-10.0.Z.E2S:grafana-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debuginfo-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-debugsource-0:10.2.6-26.el10_0.x86_64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.aarch64",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.ppc64le",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.s390x",
            "AppStream-10.0.Z.E2S:grafana-selinux-0:10.2.6-26.el10_0.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages"
    }
  ]
}

CVE-2026-42127 (GCVE-0-2026-42127)

Vulnerability from cvelistv5 – Published: 2026-06-22 16:31 – Updated: 2026-08-27 17:22

Title

Pre-authentication denial of service in the public dashboard query endpoint

Summary

The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads. This can lead to denial of service through memory exhaustion. No valid dashboard access token or authentication is required to exploit this vulnerability.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-22 17:28 UTC

CWE

CWE-400
CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

GRAFANA mitre root

References

1 reference

URL	Tags
https://grafana.com/security/security-advisories/…	vendor-advisory

Impacted products

2 products

Vendor	Product	Version
Grafana	Grafana Enterprise	Affected: 11.6.0 , ≤ 11.6.14 (semver) Affected: 12.2.0 , ≤ 12.2.8 (semver) Affected: 12.3.0 , ≤ 12.3.6 (semver) Affected: 12.4.0 , ≤ 12.4.3 (semver) Affected: 13.0.0 , ≤ 13.0.1 (semver)
Grafana	Grafana OSS	Affected: 11.6.0 , ≤ 11.6.14 (semver) Affected: 12.2.0 , ≤ 12.2.8 (semver) Affected: 12.3.0 , ≤ 12.3.6 (semver) Affected: 12.4.0 , ≤ 12.4.3 (semver) Affected: 13.0.0 , ≤ 13.0.1 (semver)

Date Public

2026-06-09 00:00

Credits

Charlie Lewis

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-42127",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-22T17:28:16.184877Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-770",
                "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-22T17:28:35.835Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Grafana Enterprise",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThanOrEqual": "11.6.14",
              "status": "affected",
              "version": "11.6.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.2.8",
              "status": "affected",
              "version": "12.2.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.3.6",
              "status": "affected",
              "version": "12.3.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.4.3",
              "status": "affected",
              "version": "12.4.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "13.0.1",
              "status": "affected",
              "version": "13.0.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Grafana OSS",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThanOrEqual": "11.6.14",
              "status": "affected",
              "version": "11.6.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.2.8",
              "status": "affected",
              "version": "12.2.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.3.6",
              "status": "affected",
              "version": "12.3.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.4.3",
              "status": "affected",
              "version": "12.4.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "13.0.1",
              "status": "affected",
              "version": "13.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Charlie Lewis"
        }
      ],
      "datePublic": "2026-06-09T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessive memory allocation by sending arbitrarily large JSON payloads. This can lead to denial of service through memory exhaustion. No valid dashboard access token or authentication is required to exploit this vulnerability."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T17:22:36.246Z",
        "orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
        "shortName": "GRAFANA"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://grafana.com/security/security-advisories/cve-2026-42127"
        }
      ],
      "source": {
        "discovery": "EXTERNAL_REPORT"
      },
      "title": "Pre-authentication denial of service in the public dashboard query endpoint",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
    "assignerShortName": "GRAFANA",
    "cveId": "CVE-2026-42127",
    "datePublished": "2026-06-22T16:31:28.096Z",
    "dateReserved": "2026-04-24T15:38:08.066Z",
    "dateUpdated": "2026-08-27T17:22:36.246Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-42499 (GCVE-0-2026-42499)

Vulnerability from cvelistv5 – Published: 2026-05-07 19:41 – Updated: 2026-09-15 12:04

Title

Quadratic string concatenation in consumePhrase in net/mail

Summary

Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-08 16:55 UTC

CWE

CWE-407 - Inefficient Algorithmic Complexity
CWE-1046 - Creation of Immutable Text Using String Concatenation

Assigner

Go Google root

References

95 references

URL	Tags
https://go.dev/issue/78987
https://go.dev/cl/771520
https://groups.google.com/g/golang-announce/c/qcC…
https://pkg.go.dev/vuln/GO-2026-4977
https://access.redhat.com/security/cve/CVE-2026-42499	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2467809	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:50319	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:59830	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:56785	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:56910	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:56852	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:60018	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:57482	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:54552	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:50336	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:57845	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:57914	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:63636	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:49702	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:67517	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:65335	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:66327	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:63332	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:22120	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:63022	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:65534	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:65116	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:65895	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:64818	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:63163	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:22112	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:62407	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:67148	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:61253	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:62754	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:57649	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:62753	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:49712	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:51112	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:65336	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:62803	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:22121	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:62406	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:65886	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:65117	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:65153	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:54531	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:34364	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:56340	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:47952	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:50843	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:51033	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:59467	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:66022	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:43692	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36319	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36625	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36754	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:33574	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:17713	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:17714	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:41928	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:50300	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:43038	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:42644	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:60520	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:59833	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:56789	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:56912	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:56854	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:60023	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:57487	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:54555	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:54583	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:54602	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:62260	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:33120	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:33123	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:33142	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:33150	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:54287	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:54284	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:54286	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:54285	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:54274	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:54283	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:41031	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:42146	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:43052	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:42796	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:41066	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:40262	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36797	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:57194	vendor-advisoryx_refsource_REDHAT

Impacted products

180 products

Vendor	Product	Version
Go standard library	net/mail	Affected: 0 , < 1.25.10 (semver) Affected: 1.26.0-0 , < 1.26.3 (semver)
Red Hat	Red Hat Ansible Automation Platform 2.5 for RHEL 8	Unaffected: 0:2.5.10-7.el8ap , < * (rpm) cpe:/a:redhat:ansible_automation_platform:2.5::el8
Red Hat	Red Hat Ansible Automation Platform 2.5 for RHEL 9	Unaffected: 0:2.6.17-2.el9ap , < * (rpm) cpe:/a:redhat:ansible_automation_platform:2.5::el9
Red Hat	Red Hat Ansible Automation Platform 2.6 for RHEL 9	Unaffected: 0:2.6.17-2.el9ap , < * (rpm) cpe:/a:redhat:ansible_automation_platform:2.6::el9
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:1.26.3-4.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:10.2.6-28.el10_2.5 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 2:1.43.1-5.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 2:1.22.2-5.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:0.152.1-2.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:52.1-1.el10_2.2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:165.1-3.el10_2.2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 0:1.26.5-1.el10_0 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 0:2.21.0-3.el10_0.4 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 0:134.1-12.el10_0 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 8100020260518131104.a3795dee , < * (rpm) cpe:/a:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:9.2.10-33.el8_10 , < * (rpm) cpe:/a:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 8100020260901110702.afee755d , < * (rpm) cpe:/a:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:101.5-3.el8_10 , < * (rpm) cpe:/a:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:1.26.3-1.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:10.2.6-23.el9_8.3 , < * (rpm) cpe:/a:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:0.152.1-2.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:165.1-4.el9_8.1 , < * (rpm) cpe:/a:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:52.1-1.el9_8.2 , < * (rpm) cpe:/a:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	Unaffected: 0:1.26.5-1.el9_2 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.2
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	Unaffected: 0:76.1-9.el9_2 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.2
Red Hat	Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	Unaffected: 0:1.26.5-1.el9_4 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.4
Red Hat	Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	Unaffected: 0:101.3-4.el9_4.6 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.4
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 0:1.26.5-1.el9_6 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 0:10.2.6-22.el9_6 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 0:132.2-12.el9_6 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 0:2.21.0-7.el9_6.1 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6
Red Hat	Red Hat OpenShift Container Platform 4.12	Unaffected: 0:1.25.5-34.rhaos4.12.git6120b13.el8 , < * (rpm) cpe:/a:redhat:openshift:4.12::el8
Red Hat	Red Hat OpenShift Container Platform 4.12	Unaffected: 0:4.12.0-202608131627.p2.g0e18cfc.assembly.stream.el8 , < * (rpm) cpe:/a:redhat:openshift:4.12::el8
Red Hat	Red Hat OpenShift Container Platform 4.14	Unaffected: 0:1.27.8-19.rhaos4.14.gitcea2db1.el8 , < * (rpm) cpe:/a:redhat:openshift:4.14::el8
Red Hat	Red Hat OpenShift Container Platform 4.14	Unaffected: 0:4.14.0-202608131802.p2.g9a7820e.assembly.stream.el8 , < * (rpm) cpe:/a:redhat:openshift:4.14::el8
Red Hat	Red Hat OpenShift Container Platform 4.15	Unaffected: 0:1.28.11-14.rhaos4.15.gitf722b2f.el8 , < * (rpm) cpe:/a:redhat:openshift:4.15::el8
Red Hat	Red Hat OpenShift Container Platform 4.15	Unaffected: 0:4.15.0-202608131733.p2.g5cb2ef4.assembly.stream.el8 , < * (rpm) cpe:/a:redhat:openshift:4.15::el8
Red Hat	Red Hat OpenShift Container Platform 4.15	Unaffected: 0:4.15.0-202608131733.p2.g8231637.assembly.stream.el8 , < * (rpm) cpe:/a:redhat:openshift:4.15::el8
Red Hat	Red Hat OpenShift Container Platform 4.15	Unaffected: 0:4.15.0-202608131733.p2.gfd77d92.assembly.stream.el8 , < * (rpm) cpe:/a:redhat:openshift:4.15::el8
Red Hat	Red Hat OpenShift Container Platform 4.15	Unaffected: 0:4.15.0-202608131733.p2.g5638728.assembly.stream.el8 , < * (rpm) cpe:/a:redhat:openshift:4.15::el8
Red Hat	Red Hat OpenShift Container Platform 4.15	Unaffected: 0:4.15.0-202608131733.p2.gfc50272.assembly.stream.el8 , < * (rpm) cpe:/a:redhat:openshift:4.15::el8
Red Hat	Red Hat OpenShift Container Platform 4.16	Unaffected: 0:1.29.13-12.rhaos4.16.git979a5e6.el8 , < * (rpm) cpe:/a:redhat:openshift:4.16::el8
Red Hat	Red Hat OpenShift Container Platform 4.16	Unaffected: 0:4.16.0-202608111505.p2.g41c4e9b.assembly.stream.el8 , < * (rpm) cpe:/a:redhat:openshift:4.16::el8
Red Hat	Red Hat OpenShift Container Platform 4.16	Unaffected: 0:4.16.0-202608111505.p2.g6f88b58.assembly.stream.el8 , < * (rpm) cpe:/a:redhat:openshift:4.16::el8
Red Hat	Red Hat OpenShift Container Platform 4.16	Unaffected: 0:4.16.0-202608111505.p2.ga53e9de.assembly.stream.el8 , < * (rpm) cpe:/a:redhat:openshift:4.16::el8
Red Hat	Red Hat OpenShift Container Platform 4.16	Unaffected: 0:4.16.0-202608111505.p2.ga3ebdc0.assembly.stream.el8 , < * (rpm) cpe:/a:redhat:openshift:4.16::el8
Red Hat	Red Hat OpenShift Container Platform 4.16	Unaffected: 0:4.16.0-202608111505.p2.g26b43df.assembly.stream.el8 , < * (rpm) cpe:/a:redhat:openshift:4.16::el8
Red Hat	Red Hat OpenShift Container Platform 4.16	Unaffected: 0:4.16.69-202608202336.p0.g763478c.assembly.4.16.69.el9 , < * (rpm) cpe:/a:redhat:openshift:4.16::el9
Red Hat	Red Hat OpenShift Container Platform 4.17	Unaffected: 0:1.30.14-11.rhaos4.17.git1e2a16d.el8 , < * (rpm) cpe:/a:redhat:openshift:4.17::el8
Red Hat	Red Hat OpenShift Container Platform 4.17	Unaffected: 0:4.17.0-202608132055.p2.g4e295fa.assembly.stream.el8 , < * (rpm) cpe:/a:redhat:openshift:4.17::el8
Red Hat	Red Hat OpenShift Container Platform 4.17	Unaffected: 0:4.17.0-202608201812.p2.g7189593.assembly.stream.el8 , < * (rpm) cpe:/a:redhat:openshift:4.17::el8
Red Hat	Red Hat OpenShift Container Platform 4.17	Unaffected: 0:4.17.0-202608122146.p2.g144bace.assembly.stream.el8 , < * (rpm) cpe:/a:redhat:openshift:4.17::el8
Red Hat	Red Hat OpenShift Container Platform 4.17	Unaffected: 0:4.17.0-202608122146.p2.g5bcfbfd.assembly.stream.el8 , < * (rpm) cpe:/a:redhat:openshift:4.17::el8
Red Hat	Red Hat OpenShift Container Platform 4.17	Unaffected: 0:4.17.0-202608122146.p2.g8ce997d.assembly.stream.el8 , < * (rpm) cpe:/a:redhat:openshift:4.17::el8
Red Hat	Red Hat OpenShift Container Platform 4.18	Unaffected: 0:1.31.13-11.rhaos4.18.git817a650.el9 , < * (rpm) cpe:/a:redhat:openshift:4.18::el8
Red Hat	Red Hat OpenShift Container Platform 4.18	Unaffected: 0:4.18.0-202608132034.p2.g91c2408.assembly.stream.el8 , < * (rpm) cpe:/a:redhat:openshift:4.18::el8
Red Hat	Red Hat OpenShift Container Platform 4.18	Unaffected: 0:4.18.0-202608132034.p2.g6febe61.assembly.stream.el8 , < * (rpm) cpe:/a:redhat:openshift:4.18::el8
Red Hat	Red Hat OpenShift Container Platform 4.18	Unaffected: 0:4.18.0-202608121933.p2.gc395190.assembly.stream.el8 , < * (rpm) cpe:/a:redhat:openshift:4.18::el8
Red Hat	Red Hat OpenShift Container Platform 4.18	Unaffected: 0:4.18.0-202608121933.p2.g9795abd.assembly.stream.el8 , < * (rpm) cpe:/a:redhat:openshift:4.18::el8
Red Hat	Red Hat OpenShift Container Platform 4.18	Unaffected: 0:4.18.0-202608121933.p2.g6ea2356.assembly.stream.el8 , < * (rpm) cpe:/a:redhat:openshift:4.18::el8
Red Hat	Red Hat OpenShift Container Platform 4.18	Unaffected: 0:4.18.54-202608211117.p0.g8eb6c29.assembly.4.18.54.el9 , < * (rpm) cpe:/a:redhat:openshift:4.18::el9
Red Hat	Red Hat OpenShift Container Platform 4.19	Unaffected: 0:1.32.13-9.rhaos4.19.git2100f27.el9 , < * (rpm) cpe:/a:redhat:openshift:4.19::el8
Red Hat	Red Hat OpenShift Container Platform 4.19	Unaffected: 0:4.19.0-202608111604.p2.g63adf01.assembly.stream.el9 , < * (rpm) cpe:/a:redhat:openshift:4.19::el8
Red Hat	Red Hat OpenShift Container Platform 4.19	Unaffected: 0:4.19.0-202608111604.p2.gb2a93a6.assembly.stream.el8 , < * (rpm) cpe:/a:redhat:openshift:4.19::el8
Red Hat	Red Hat OpenShift Container Platform 4.19	Unaffected: 0:4.19.0-202608111604.p2.g425c1c5.assembly.stream.el9 , < * (rpm) cpe:/a:redhat:openshift:4.19::el8
Red Hat	Red Hat OpenShift Container Platform 4.19	Unaffected: 0:4.19.46-202609041024.p0.g59e34c7.assembly.4.19.46.el9 , < * (rpm) cpe:/a:redhat:openshift:4.19::el9
Red Hat	Cert Manager support for Red Hat OpenShift release 1.19	Unaffected: 1786613805 , < * (rpm) cpe:/a:redhat:cert_manager:1.19::el9
Red Hat	Logging for Red Hat OpenShift 6	Unaffected: 1785419067 , < * (rpm) cpe:/a:redhat:logging:6.0::el9
Red Hat	Logging for Red Hat OpenShift 6.2	Unaffected: 1784748010 , < * (rpm) cpe:/a:redhat:logging:6.2::el9
Red Hat	Logging Subsystem for Red Hat OpenShift 6.4	Unaffected: 1782405469 , < * (rpm) cpe:/a:redhat:logging:6.4::el9
Red Hat	Logging Subsystem for Red Hat OpenShift 6.5	Unaffected: 1786645248 , < * (rpm) cpe:/a:redhat:logging:6.5::el9
Red Hat	multicluster engine for Kubernetes 2.11	Unaffected: 1786911952 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.11::el9
Red Hat	multicluster engine for Kubernetes 2.11	Unaffected: 1786912006 , < * (rpm) cpe:/a:redhat:multicluster_engine:2.11::el9
Red Hat	OpenShift API for Data Protection 1.3	Unaffected: 1785177357 , < * (rpm) cpe:/a:redhat:openshift_api_data_protection:1.3::el9
Red Hat	OpenShift API for Data Protection 1.4	Unaffected: 1786946116 , < * (rpm) cpe:/a:redhat:openshift_api_data_protection:1.4::el9
Red Hat	OpenShift API for Data Protection 1.5	Unaffected: 1788860461 , < * (rpm) cpe:/a:redhat:openshift_api_data_protection:1.5::el9
Red Hat	OpenShift API for Data Protection 1.6	Unaffected: 1784058822 , < * (rpm) cpe:/a:redhat:openshift_api_data_protection:1.6::el9
Red Hat	Red Hat Advanced Cluster Security 4.9	Unaffected: 1783357116 , < * (rpm) cpe:/a:redhat:advanced_cluster_security:4.9::el8
Red Hat	Red Hat Advanced Cluster Security for Kubernetes 4.10	Unaffected: 1783357140 , < * (rpm) cpe:/a:redhat:advanced_cluster_security:4.10::el8
Red Hat	Red Hat Developer Hub 1.10	Unaffected: 1783447707 , < * (rpm) cpe:/a:redhat:rhdh:1.10::el9
Red Hat	Red Hat Developer Hub 1.9	Unaffected: 1782767215 , < * (rpm) cpe:/a:redhat:rhdh:1.9::el9
Red Hat	Red Hat Hardened Images	Unaffected: 1.25.10-2.2.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat Hardened Images	Unaffected: 1.26.3-2.2.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat Migration Toolkit 1.8	Unaffected: 1783953372 , < * (rpm) cpe:/a:redhat:rhmt:1.8::el8
Red Hat	Red Hat Migration Toolkit for Applications 8.1	Unaffected: 1785171639 , < * (rpm) cpe:/a:redhat:migration_toolkit_applications:8.1::el9
Red Hat	Red Hat Migration Toolkit for Applications 8.2	Unaffected: 1784211378 , < * (rpm) cpe:/a:redhat:migration_toolkit_applications:8.2::el9
Red Hat	Red Hat OpenShift AI 2.25	Unaffected: 1783544461 , < * (rpm) cpe:/a:redhat:openshift_ai:2.25::el9
Red Hat	Red Hat OpenShift AI 3.4	Unaffected: 1787102977 , < * (rpm) cpe:/a:redhat:openshift_ai:3.4::el9
Red Hat	Red Hat OpenShift AI 3.4	Unaffected: 1786611759 , < * (rpm) cpe:/a:redhat:openshift_ai:3.4::el9
Red Hat	Red Hat OpenShift AI 3.4	Unaffected: 1787562200 , < * (rpm) cpe:/a:redhat:openshift_ai:3.4::el9
Red Hat	Red Hat OpenShift Container Platform 4.12	Unaffected: 1786752886 , < * (rpm) cpe:/a:redhat:openshift:4.12::el9
Red Hat	Red Hat OpenShift Container Platform 4.14	Unaffected: 1787002807 , < * (rpm) cpe:/a:redhat:openshift:4.14::el9
Red Hat	Red Hat OpenShift Container Platform 4.15	Unaffected: 1787055135 , < * (rpm) cpe:/a:redhat:openshift:4.15::el9
Red Hat	Red Hat OpenShift Container Platform 4.16	Unaffected: 1786788280 , < * (rpm) cpe:/a:redhat:openshift:4.16::el9
Red Hat	Red Hat OpenShift Container Platform 4.17	Unaffected: 1787549445 , < * (rpm) cpe:/a:redhat:openshift:4.17::el9
Red Hat	Red Hat OpenShift Container Platform 4.18	Unaffected: 1786754308 , < * (rpm) cpe:/a:redhat:openshift:4.18::el9
Red Hat	Red Hat OpenShift Container Platform 4.19	Unaffected: 1786489910 , < * (rpm) cpe:/a:redhat:openshift:4.19::el9
Red Hat	Red Hat OpenShift Container Platform 4.20	Unaffected: 1786494900 , < * (rpm) cpe:/a:redhat:openshift:4.20::el9
Red Hat	Red Hat OpenShift Container Platform 4.21	Unaffected: 1786496647 , < * (rpm) cpe:/a:redhat:openshift:4.21::el9
Red Hat	Red Hat OpenShift Container Platform 4.21	Unaffected: 1786573075 , < * (rpm) cpe:/a:redhat:openshift:4.21::el9
Red Hat	Red Hat OpenShift Dev Spaces 3.30	Unaffected: 1787756267 , < * (rpm) cpe:/a:redhat:openshift_devspaces:3.30::el9
Red Hat	Red Hat OpenShift Dev Spaces 3.30	Unaffected: 1787756799 , < * (rpm) cpe:/a:redhat:openshift_devspaces:3.30::el9
Red Hat	Red Hat OpenShift Service Mesh 3.0	Unaffected: 1782222217 , < * (rpm) cpe:/a:redhat:service_mesh:3.0::el9
Red Hat	Red Hat OpenShift Service Mesh 3.0	Unaffected: 1782223341 , < * (rpm) cpe:/a:redhat:service_mesh:3.0::el9
Red Hat	Red Hat OpenShift Service Mesh 3.0	Unaffected: 1782296193 , < * (rpm) cpe:/a:redhat:service_mesh:3.0::el9
Red Hat	Red Hat OpenShift Service Mesh 3.0	Unaffected: 1782222607 , < * (rpm) cpe:/a:redhat:service_mesh:3.0::el9
Red Hat	Red Hat OpenShift Service Mesh 3.1	Unaffected: 1782222163 , < * (rpm) cpe:/a:redhat:service_mesh:3.1::el9
Red Hat	Red Hat OpenShift Service Mesh 3.1	Unaffected: 1782223138 , < * (rpm) cpe:/a:redhat:service_mesh:3.1::el9
Red Hat	Red Hat OpenShift Service Mesh 3.1	Unaffected: 1782222394 , < * (rpm) cpe:/a:redhat:service_mesh:3.1::el9
Red Hat	Red Hat OpenShift Service Mesh 3.1	Unaffected: 1782222451 , < * (rpm) cpe:/a:redhat:service_mesh:3.1::el9
Red Hat	Red Hat OpenShift Service Mesh 3.2	Unaffected: 1782226178 , < * (rpm) cpe:/a:redhat:service_mesh:3.2::el9
Red Hat	Red Hat OpenShift Service Mesh 3.2	Unaffected: 1782224487 , < * (rpm) cpe:/a:redhat:service_mesh:3.2::el9
Red Hat	Red Hat OpenShift Service Mesh 3.2	Unaffected: 1782303211 , < * (rpm) cpe:/a:redhat:service_mesh:3.2::el9
Red Hat	Red Hat OpenShift Service Mesh 3.2	Unaffected: 1782224541 , < * (rpm) cpe:/a:redhat:service_mesh:3.2::el9
Red Hat	Red Hat OpenShift Service Mesh 3.3	Unaffected: 1782223045 , < * (rpm) cpe:/a:redhat:service_mesh:3.3::el9
Red Hat	Red Hat OpenShift Service Mesh 3.3	Unaffected: 1782222366 , < * (rpm) cpe:/a:redhat:service_mesh:3.3::el9
Red Hat	Red Hat OpenShift Service Mesh 3.3	Unaffected: 1782310747 , < * (rpm) cpe:/a:redhat:service_mesh:3.3::el9
Red Hat	Red Hat OpenShift Service Mesh 3.3	Unaffected: 1782222038 , < * (rpm) cpe:/a:redhat:service_mesh:3.3::el9
Red Hat	Red Hat OpenShift Workload Availability 0.12	Unaffected: 1785202723 , < * (rpm) cpe:/a:redhat:workload_availability_nhc:0.12::el9
Red Hat	Red Hat OpenShift Workload Availability 0.13	Unaffected: 1785203036 , < * (rpm) cpe:/a:redhat:workload_availability_snr:0.13::el9
Red Hat	Red Hat OpenShift Workload Availability 0.3	Unaffected: 1785203474 , < * (rpm) cpe:/a:redhat:workload_availability_sbr:0.3::el9
Red Hat	Red Hat OpenShift Workload Availability 0.7	Unaffected: 1785203508 , < * (rpm) cpe:/a:redhat:workload_availability_mdr:0.7::el9
Red Hat	Red Hat OpenShift Workload Availability 0.8	Unaffected: 1785203079 , < * (rpm) cpe:/a:redhat:workload_availability_far:0.8::el9
Red Hat	Red Hat OpenShift Workload Availability 5.7	Unaffected: 1785202847 , < * (rpm) cpe:/a:redhat:workload_availability_nmo:5.7::el9
Red Hat	Red Hat Quay 3.10	Unaffected: 1783750447 , < * (rpm) cpe:/a:redhat:quay:3.10::el8
Red Hat	Red Hat Quay 3.12	Unaffected: 1783751865 , < * (rpm) Unaffected: 1784353904 , < * (rpm) cpe:/a:redhat:quay:3.12::el8
Red Hat	Red Hat Quay 3.15	Unaffected: 1784351966 , < * (rpm) cpe:/a:redhat:quay:3.15::el8
Red Hat	Red Hat Quay 3.16	Unaffected: 1783955846 , < * (rpm) cpe:/a:redhat:quay:3.16::el9
Red Hat	Red Hat Quay 3.9	Unaffected: 1784125838 , < * (rpm) cpe:/a:redhat:quay:3.9::el8
Red Hat	Red Hat Trusted Artifact Signer 1.4	Unaffected: 4-1.4.2 , < * (rpm) Unaffected: 4-1.4.3 , < * (rpm) cpe:/a:redhat:trusted_artifact_signer:1.4::el9
Red Hat	Assisted Installer for Red Hat OpenShift Container Platform 2	cpe:/a:redhat:assisted_installer:2
Red Hat	Confidential Compute Attestation	cpe:/a:redhat:confidential_compute_attestation:1
Red Hat	Cryostat 4	cpe:/a:redhat:cryostat:4
Red Hat	Custom Metric Autoscaler operator for Red Hat Openshift	cpe:/a:redhat:openshift_custom_metrics_autoscaler:2
Red Hat	ExternalDNS Operator	cpe:/a:redhat:ext_dns_optr:1
Red Hat	External Secrets Operator for Red Hat OpenShift	cpe:/a:redhat:external_secrets_operator:1
Red Hat	File Integrity Operator	cpe:/a:redhat:openshift_file_integrity_operator:1
Red Hat	Gatekeeper 3	cpe:/a:redhat:gatekeeper:3
Red Hat	Logical Volume Manager Storage	cpe:/a:redhat:lvms:4
Red Hat	Multiarch Tuning Operator	cpe:/a:redhat:multiarch_tuning_operator
Red Hat	Multicluster Engine for Kubernetes	cpe:/a:redhat:multicluster_engine
Red Hat	Multicluster Global Hub	cpe:/a:redhat:multicluster_globalhub
Red Hat	Network Observability Operator	cpe:/a:redhat:network_observ_optr:1
Red Hat	OpenShift Developer Tools and Services	cpe:/a:redhat:ocp_tools
Red Hat	OpenShift Lightspeed	cpe:/a:redhat:openshift_lightspeed
Red Hat	OpenShift Pipelines	cpe:/a:redhat:openshift_pipelines:1
Red Hat	OpenShift Serverless	cpe:/a:redhat:serverless:1
Red Hat	OpenShift Service Mesh 2	cpe:/a:redhat:service_mesh:2
Red Hat	OpenShift Service Mesh 3	cpe:/a:redhat:service_mesh:3
Red Hat	Power monitoring for Red Hat OpenShift	cpe:/a:redhat:openshift_power_monitoring
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2	cpe:/a:redhat:acm:2
Red Hat	Red Hat Ansible Automation Platform 2	cpe:/a:redhat:ansible_automation_platform:2
Red Hat	Red Hat Ceph Storage 5	cpe:/a:redhat:ceph_storage:5
Red Hat	Red Hat Ceph Storage 6	cpe:/a:redhat:ceph_storage:6
Red Hat	Red Hat Ceph Storage 9	cpe:/a:redhat:ceph_storage:9
Red Hat	Red Hat Certification Program for Red Hat Enterprise Linux 9	cpe:/a:redhat:certifications:9
Red Hat	Red Hat Edge Manager 1	cpe:/a:redhat:edge_manager:1
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux 9	cpe:/o:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux AI (RHEL AI) 3	cpe:/a:redhat:enterprise_linux_ai:3
Red Hat	Red Hat Lightspeed for Runtimes Operator	cpe:/a:redhat:lightspeed_for_runtimes:1
Red Hat	Red Hat OpenShift AI (RHOAI)	cpe:/a:redhat:openshift_ai
Red Hat	Red Hat OpenShift Cluster Manager CLI	cpe:/a:redhat:openshift_cluster_manager_cli:1
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4
Red Hat	Red Hat Openshift Data Foundation 4	cpe:/a:redhat:openshift_data_foundation:4
Red Hat	Red Hat OpenShift Dev Workspaces Operator	cpe:/a:redhat:devworkspace
Red Hat	Red Hat OpenShift distributed tracing 3	cpe:/a:redhat:openshift_distributed_tracing:3
Red Hat	Red Hat OpenShift for Windows Containers	cpe:/a:redhat:windows_machine_config
Red Hat	Red Hat OpenShift GitOps	cpe:/a:redhat:openshift_gitops:1
Red Hat	Red Hat OpenShift Virtualization 4	cpe:/a:redhat:container_native_virtualization:4
Red Hat	Red Hat OpenStack Platform 16.2	cpe:/a:redhat:openstack:16.2
Red Hat	Red Hat OpenStack Platform 17.1	cpe:/a:redhat:openstack:17.1
Red Hat	Red Hat OpenStack Platform 18.0	cpe:/a:redhat:openstack:18.0
Red Hat	Red Hat Quay 3	cpe:/a:redhat:quay:3
Red Hat	Red Hat Satellite 6	cpe:/a:redhat:satellite:6
Red Hat	Red Hat Service Interconnect 1	cpe:/a:redhat:service_interconnect:1
Red Hat	Red Hat Service Interconnect 2	cpe:/a:redhat:service_interconnect:2
Red Hat	Security Profiles Operator	cpe:/a:redhat:openshift_security_profiles_operator:1
Red Hat	Zero Trust Workload Identity Manager	cpe:/a:redhat:zero_trust_workload_identity_manager:1
Red Hat	Zero Trust Workload Identity Manager - Tech Preview	cpe:/a:redhat:zero_trust_workload_identity_manager:0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-42499",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-08T16:55:28.873015Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-08T21:29:59.662Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2.5::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "automation-gateway-proxy",
            "product": "Red Hat Ansible Automation Platform 2.5 for RHEL 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.5.10-7.el8ap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2.5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "automation-gateway-proxy",
            "product": "Red Hat Ansible Automation Platform 2.5 for RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.6.17-2.el9ap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2.6::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "automation-gateway-proxy",
            "product": "Red Hat Ansible Automation Platform 2.6 for RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.6.17-2.el9ap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "golang",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.26.3-4.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "grafana",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:10.2.6-28.el10_2.5",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "buildah",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "2:1.43.1-5.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "skopeo",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "2:1.22.2-5.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "opentelemetry-collector",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:0.152.1-2.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "image-builder",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:52.1-1.el10_2.2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "osbuild-composer",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:165.1-3.el10_2.2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux_eus:10.0"
            ],
            "defaultStatus": "affected",
            "packageName": "golang",
            "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.26.5-1.el10_0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux_eus:10.0"
            ],
            "defaultStatus": "affected",
            "packageName": "ignition",
            "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.21.0-3.el10_0.4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux_eus:10.0"
            ],
            "defaultStatus": "affected",
            "packageName": "osbuild-composer",
            "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:134.1-12.el10_0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "go-toolset:rhel8",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8100020260518131104.a3795dee",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "grafana",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:9.2.10-33.el8_10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "container-tools:rhel8",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8100020260901110702.afee755d",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "osbuild-composer",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:101.5-3.el8_10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "golang",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.26.3-1.el9_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "grafana",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:10.2.6-23.el9_8.3",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "opentelemetry-collector",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:0.152.1-2.el9_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "osbuild-composer",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:165.1-4.el9_8.1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "image-builder",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:52.1-1.el9_8.2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.2"
            ],
            "defaultStatus": "affected",
            "packageName": "golang",
            "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.26.5-1.el9_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.2"
            ],
            "defaultStatus": "affected",
            "packageName": "osbuild-composer",
            "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:76.1-9.el9_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.4"
            ],
            "defaultStatus": "affected",
            "packageName": "golang",
            "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.26.5-1.el9_4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.4"
            ],
            "defaultStatus": "affected",
            "packageName": "osbuild-composer",
            "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:101.3-4.el9_4.6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "golang",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.26.5-1.el9_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "grafana",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:10.2.6-22.el9_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "osbuild-composer",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:132.2-12.el9_6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "ignition",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.21.0-7.el9_6.1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.12::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "cri-o",
            "product": "Red Hat OpenShift Container Platform 4.12",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.25.5-34.rhaos4.12.git6120b13.el8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.12::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift",
            "product": "Red Hat OpenShift Container Platform 4.12",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.12.0-202608131627.p2.g0e18cfc.assembly.stream.el8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.14::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "cri-o",
            "product": "Red Hat OpenShift Container Platform 4.14",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.27.8-19.rhaos4.14.gitcea2db1.el8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.14::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "ose-aws-ecr-image-credential-provider",
            "product": "Red Hat OpenShift Container Platform 4.14",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.14.0-202608131802.p2.g9a7820e.assembly.stream.el8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.15::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "cri-o",
            "product": "Red Hat OpenShift Container Platform 4.15",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.28.11-14.rhaos4.15.gitf722b2f.el8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.15::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift",
            "product": "Red Hat OpenShift Container Platform 4.15",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.15.0-202608131733.p2.g5cb2ef4.assembly.stream.el8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.15::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-clients",
            "product": "Red Hat OpenShift Container Platform 4.15",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.15.0-202608131733.p2.g8231637.assembly.stream.el8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.15::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "ose-aws-ecr-image-credential-provider",
            "product": "Red Hat OpenShift Container Platform 4.15",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.15.0-202608131733.p2.gfd77d92.assembly.stream.el8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.15::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "ose-azure-acr-image-credential-provider",
            "product": "Red Hat OpenShift Container Platform 4.15",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.15.0-202608131733.p2.g5638728.assembly.stream.el8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.15::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "ose-gcp-gcr-image-credential-provider",
            "product": "Red Hat OpenShift Container Platform 4.15",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.15.0-202608131733.p2.gfc50272.assembly.stream.el8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.16::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "cri-o",
            "product": "Red Hat OpenShift Container Platform 4.16",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.29.13-12.rhaos4.16.git979a5e6.el8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.16::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift",
            "product": "Red Hat OpenShift Container Platform 4.16",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.16.0-202608111505.p2.g41c4e9b.assembly.stream.el8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.16::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-clients",
            "product": "Red Hat OpenShift Container Platform 4.16",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.16.0-202608111505.p2.g6f88b58.assembly.stream.el8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.16::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "ose-aws-ecr-image-credential-provider",
            "product": "Red Hat OpenShift Container Platform 4.16",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.16.0-202608111505.p2.ga53e9de.assembly.stream.el8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.16::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "ose-azure-acr-image-credential-provider",
            "product": "Red Hat OpenShift Container Platform 4.16",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.16.0-202608111505.p2.ga3ebdc0.assembly.stream.el8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.16::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "ose-gcp-gcr-image-credential-provider",
            "product": "Red Hat OpenShift Container Platform 4.16",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.16.0-202608111505.p2.g26b43df.assembly.stream.el8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.16::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "microshift",
            "product": "Red Hat OpenShift Container Platform 4.16",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.16.69-202608202336.p0.g763478c.assembly.4.16.69.el9",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.17::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "cri-o",
            "product": "Red Hat OpenShift Container Platform 4.17",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.30.14-11.rhaos4.17.git1e2a16d.el8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.17::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift",
            "product": "Red Hat OpenShift Container Platform 4.17",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.17.0-202608132055.p2.g4e295fa.assembly.stream.el8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.17::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-clients",
            "product": "Red Hat OpenShift Container Platform 4.17",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.17.0-202608201812.p2.g7189593.assembly.stream.el8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.17::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "ose-aws-ecr-image-credential-provider",
            "product": "Red Hat OpenShift Container Platform 4.17",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.17.0-202608122146.p2.g144bace.assembly.stream.el8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.17::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "ose-azure-acr-image-credential-provider",
            "product": "Red Hat OpenShift Container Platform 4.17",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.17.0-202608122146.p2.g5bcfbfd.assembly.stream.el8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.17::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "ose-gcp-gcr-image-credential-provider",
            "product": "Red Hat OpenShift Container Platform 4.17",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.17.0-202608122146.p2.g8ce997d.assembly.stream.el8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.18::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "cri-o",
            "product": "Red Hat OpenShift Container Platform 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.31.13-11.rhaos4.18.git817a650.el9",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.18::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift",
            "product": "Red Hat OpenShift Container Platform 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-202608132034.p2.g91c2408.assembly.stream.el8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.18::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-clients",
            "product": "Red Hat OpenShift Container Platform 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-202608132034.p2.g6febe61.assembly.stream.el8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.18::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "ose-aws-ecr-image-credential-provider",
            "product": "Red Hat OpenShift Container Platform 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-202608121933.p2.gc395190.assembly.stream.el8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.18::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "ose-azure-acr-image-credential-provider",
            "product": "Red Hat OpenShift Container Platform 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-202608121933.p2.g9795abd.assembly.stream.el8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.18::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "ose-gcp-gcr-image-credential-provider",
            "product": "Red Hat OpenShift Container Platform 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.0-202608121933.p2.g6ea2356.assembly.stream.el8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.18::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "microshift",
            "product": "Red Hat OpenShift Container Platform 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.18.54-202608211117.p0.g8eb6c29.assembly.4.18.54.el9",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.19::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "cri-o",
            "product": "Red Hat OpenShift Container Platform 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.32.13-9.rhaos4.19.git2100f27.el9",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.19::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift",
            "product": "Red Hat OpenShift Container Platform 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.19.0-202608111604.p2.g63adf01.assembly.stream.el9",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.19::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-clients",
            "product": "Red Hat OpenShift Container Platform 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.19.0-202608111604.p2.gb2a93a6.assembly.stream.el8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.19::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "ose-aws-ecr-image-credential-provider",
            "product": "Red Hat OpenShift Container Platform 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.19.0-202608111604.p2.g425c1c5.assembly.stream.el9",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "microshift",
            "product": "Red Hat OpenShift Container Platform 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.19.46-202609041024.p0.g59e34c7.assembly.4.19.46.el9",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:cert_manager:1.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "cert-manager/jetstack-cert-manager-rhel9",
            "product": "Cert Manager support for Red Hat OpenShift release 1.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786613805",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:logging:6.0::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-logging/logging-loki-rhel9",
            "product": "Logging for Red Hat OpenShift 6",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1785419067",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:logging:6.2::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-logging/logging-loki-rhel9",
            "product": "Logging for Red Hat OpenShift 6.2",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784748010",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:logging:6.4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-logging/logging-loki-rhel9",
            "product": "Logging Subsystem for Red Hat OpenShift 6.4",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782405469",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:logging:6.5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-logging/logging-loki-rhel9",
            "product": "Logging Subsystem for Red Hat OpenShift 6.5",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786645248",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.11::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/backplane-rhel9-operator",
            "product": "multicluster engine for Kubernetes 2.11",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786911952",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine:2.11::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/hypershift-addon-rhel9-operator",
            "product": "multicluster engine for Kubernetes 2.11",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786912006",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_api_data_protection:1.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "oadp/oadp-velero-plugin-rhel9",
            "product": "OpenShift API for Data Protection 1.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1785177357",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_api_data_protection:1.4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "oadp/oadp-velero-plugin-rhel9",
            "product": "OpenShift API for Data Protection 1.4",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786946116",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_api_data_protection:1.5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "oadp/oadp-velero-rhel9",
            "product": "OpenShift API for Data Protection 1.5",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1788860461",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_api_data_protection:1.6::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "oadp/oadp-velero-rhel9",
            "product": "OpenShift API for Data Protection 1.6",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784058822",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:advanced_cluster_security:4.9::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "advanced-cluster-security/rhacs-main-rhel8",
            "product": "Red Hat Advanced Cluster Security 4.9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783357116",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:advanced_cluster_security:4.10::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "advanced-cluster-security/rhacs-main-rhel8",
            "product": "Red Hat Advanced Cluster Security for Kubernetes 4.10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783357140",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:rhdh:1.10::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhdh/rhdh-rhel9-operator",
            "product": "Red Hat Developer Hub 1.10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783447707",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:rhdh:1.9::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhdh/rhdh-rhel9-operator",
            "product": "Red Hat Developer Hub 1.9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782767215",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "affected",
            "packageName": "golang1-25-main",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1.25.10-2.2.hum1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "affected",
            "packageName": "golang1-26-main",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1.26.3-2.2.hum1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:rhmt:1.8::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "rhmtc/openshift-migration-controller-rhel8",
            "product": "Red Hat Migration Toolkit 1.8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783953372",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:migration_toolkit_applications:8.1::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "mta/mta-cli-rhel9",
            "product": "Red Hat Migration Toolkit for Applications 8.1",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1785171639",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:migration_toolkit_applications:8.2::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "mta/mta-cli-rhel9",
            "product": "Red Hat Migration Toolkit for Applications 8.2",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784211378",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai:2.25::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-kueue-controller-rhel9",
            "product": "Red Hat OpenShift AI 2.25",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783544461",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai:3.4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-kube-auth-proxy-rhel9",
            "product": "Red Hat OpenShift AI 3.4",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787102977",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai:3.4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-mod-arch-gen-ai-rhel9",
            "product": "Red Hat OpenShift AI 3.4",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786611759",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai:3.4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-workload-variant-autoscaler-controller-rhel9",
            "product": "Red Hat OpenShift AI 3.4",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787562200",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.12::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift4/ose-installer",
            "product": "Red Hat OpenShift Container Platform 4.12",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786752886",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.14::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift4/ose-sdn-rhel8",
            "product": "Red Hat OpenShift Container Platform 4.14",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787002807",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.15::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift4/ose-sdn-rhel9",
            "product": "Red Hat OpenShift Container Platform 4.15",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787055135",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.16::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift4/ose-sdn-rhel9",
            "product": "Red Hat OpenShift Container Platform 4.16",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786788280",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.17::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift4/ose-cli-rhel9",
            "product": "Red Hat OpenShift Container Platform 4.17",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787549445",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.18::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift4/ose-cli-rhel9",
            "product": "Red Hat OpenShift Container Platform 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786754308",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift4/ose-cli-rhel9",
            "product": "Red Hat OpenShift Container Platform 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786489910",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift4/ose-cli-rhel9",
            "product": "Red Hat OpenShift Container Platform 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786494900",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.21::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift4/ose-cli-rhel9",
            "product": "Red Hat OpenShift Container Platform 4.21",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786496647",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.21::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift4/ose-hypershift-rhel9",
            "product": "Red Hat OpenShift Container Platform 4.21",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786573075",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_devspaces:3.30::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "devspaces/configbump-rhel9",
            "product": "Red Hat OpenShift Dev Spaces 3.30",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787756267",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_devspaces:3.30::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "devspaces/traefik-rhel9",
            "product": "Red Hat OpenShift Dev Spaces 3.30",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787756799",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.0::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/istio-cni-rhel9",
            "product": "Red Hat OpenShift Service Mesh 3.0",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782222217",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.0::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/istio-pilot-rhel9",
            "product": "Red Hat OpenShift Service Mesh 3.0",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782223341",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.0::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/istio-proxyv2-rhel9",
            "product": "Red Hat OpenShift Service Mesh 3.0",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782296193",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.0::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/istio-rhel9-operator",
            "product": "Red Hat OpenShift Service Mesh 3.0",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782222607",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.1::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/istio-cni-rhel9",
            "product": "Red Hat OpenShift Service Mesh 3.1",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782222163",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.1::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/istio-pilot-rhel9",
            "product": "Red Hat OpenShift Service Mesh 3.1",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782223138",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.1::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/istio-proxyv2-rhel9",
            "product": "Red Hat OpenShift Service Mesh 3.1",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782222394",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.1::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/istio-rhel9-operator",
            "product": "Red Hat OpenShift Service Mesh 3.1",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782222451",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.2::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/istio-cni-rhel9",
            "product": "Red Hat OpenShift Service Mesh 3.2",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782226178",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.2::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/istio-pilot-rhel9",
            "product": "Red Hat OpenShift Service Mesh 3.2",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782224487",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.2::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/istio-proxyv2-rhel9",
            "product": "Red Hat OpenShift Service Mesh 3.2",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782303211",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.2::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/istio-rhel9-operator",
            "product": "Red Hat OpenShift Service Mesh 3.2",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782224541",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/istio-cni-rhel9",
            "product": "Red Hat OpenShift Service Mesh 3.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782223045",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/istio-pilot-rhel9",
            "product": "Red Hat OpenShift Service Mesh 3.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782222366",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/istio-proxyv2-rhel9",
            "product": "Red Hat OpenShift Service Mesh 3.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782310747",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/istio-rhel9-operator",
            "product": "Red Hat OpenShift Service Mesh 3.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782222038",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:workload_availability_nhc:0.12::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "workload-availability/node-healthcheck-rhel9-operator",
            "product": "Red Hat OpenShift Workload Availability 0.12",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1785202723",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:workload_availability_snr:0.13::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "workload-availability/self-node-remediation-rhel9-operator",
            "product": "Red Hat OpenShift Workload Availability 0.13",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1785203036",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:workload_availability_sbr:0.3::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "workload-availability/storage-based-remediation-rhel9-operator",
            "product": "Red Hat OpenShift Workload Availability 0.3",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1785203474",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:workload_availability_mdr:0.7::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "workload-availability/machine-deletion-remediation-rhel9-operator",
            "product": "Red Hat OpenShift Workload Availability 0.7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1785203508",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:workload_availability_far:0.8::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "workload-availability/fence-agents-remediation-rhel9-operator",
            "product": "Red Hat OpenShift Workload Availability 0.8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1785203079",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:workload_availability_nmo:5.7::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "workload-availability/node-maintenance-rhel9-operator",
            "product": "Red Hat OpenShift Workload Availability 5.7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1785202847",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:quay:3.10::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "quay/quay-rhel8",
            "product": "Red Hat Quay 3.10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783750447",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:quay:3.12::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "quay/quay-rhel8",
            "product": "Red Hat Quay 3.12",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783751865",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784353904",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:quay:3.15::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "quay/quay-rhel8",
            "product": "Red Hat Quay 3.15",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784351966",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:quay:3.16::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "quay/quay-rhel9",
            "product": "Red Hat Quay 3.16",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783955846",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:quay:3.9::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "quay/quay-rhel8",
            "product": "Red Hat Quay 3.9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784125838",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:trusted_artifact_signer:1.4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "conforma-cli-stack-v1",
            "product": "Red Hat Trusted Artifact Signer 1.4",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4-1.4.2",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4-1.4.3",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:assisted_installer:2"
            ],
            "defaultStatus": "affected",
            "packageName": "rhai/assisted-installer-rhel9",
            "product": "Assisted Installer for Red Hat OpenShift Container Platform 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:confidential_compute_attestation:1"
            ],
            "defaultStatus": "affected",
            "packageName": "build-of-trustee/trustee-rhel9-operator",
            "product": "Confidential Compute Attestation",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:confidential_compute_attestation:1"
            ],
            "defaultStatus": "affected",
            "packageName": "confidential-compute-attestation-tech-preview/trustee-rhel9-operator",
            "product": "Confidential Compute Attestation",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:confidential_compute_attestation:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-sandboxed-containers/osc-monitor-rhel9",
            "product": "Confidential Compute Attestation",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:cryostat:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "cryostat/cryostat-storage-rhel9",
            "product": "Cryostat 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_custom_metrics_autoscaler:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9",
            "product": "Custom Metric Autoscaler operator for Red Hat Openshift",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ext_dns_optr:1"
            ],
            "defaultStatus": "affected",
            "packageName": "edo/external-dns-rhel9",
            "product": "ExternalDNS Operator",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ext_dns_optr:1"
            ],
            "defaultStatus": "affected",
            "packageName": "edo/external-dns-rhel9-operator",
            "product": "ExternalDNS Operator",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:external_secrets_operator:1"
            ],
            "defaultStatus": "affected",
            "packageName": "external-secrets-operator/external-secrets-rhel9",
            "product": "External Secrets Operator for Red Hat OpenShift",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_file_integrity_operator:1"
            ],
            "defaultStatus": "affected",
            "packageName": "compliance/openshift-compliance-operator-bundle",
            "product": "File Integrity Operator",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:gatekeeper:3"
            ],
            "defaultStatus": "affected",
            "packageName": "gatekeeper/gatekeeper-rhel9-operator",
            "product": "Gatekeeper 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:lvms:4"
            ],
            "defaultStatus": "affected",
            "packageName": "lvms4/lvms-rhel9-operator",
            "product": "Logical Volume Manager Storage",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:lvms:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "lvms4/topolvm-rhel8",
            "product": "Logical Volume Manager Storage",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:lvms:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "lvms4/topolvm-rhel9",
            "product": "Logical Volume Manager Storage",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:multiarch_tuning_operator"
            ],
            "defaultStatus": "unaffected",
            "packageName": "multiarch-tuning/multiarch-tuning-rhel9-operator",
            "product": "Multiarch Tuning Operator",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/addon-manager-rhel9",
            "product": "Multicluster Engine for Kubernetes",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/assisted-installer-rhel8",
            "product": "Multicluster Engine for Kubernetes",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine"
            ],
            "defaultStatus": "unknown",
            "packageName": "multicluster-engine/assisted-installer-rhel9",
            "product": "Multicluster Engine for Kubernetes",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/clusterlifecycle-state-metrics-rhel9",
            "product": "Multicluster Engine for Kubernetes",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine"
            ],
            "defaultStatus": "unaffected",
            "packageName": "multicluster-engine/discovery-rhel9",
            "product": "Multicluster Engine for Kubernetes",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/maestro-rhel9",
            "product": "Multicluster Engine for Kubernetes",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/managedcluster-import-controller-rhel9",
            "product": "Multicluster Engine for Kubernetes",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/multicloud-manager-rhel9",
            "product": "Multicluster Engine for Kubernetes",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/placement-rhel9",
            "product": "Multicluster Engine for Kubernetes",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/registration-operator-rhel9",
            "product": "Multicluster Engine for Kubernetes",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:multicluster_engine"
            ],
            "defaultStatus": "affected",
            "packageName": "multicluster-engine/work-rhel9",
            "product": "Multicluster Engine for Kubernetes",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:multicluster_globalhub"
            ],
            "defaultStatus": "unknown",
            "packageName": "multicluster-globalhub/multicluster-globalhub-agent-rhel8",
            "product": "Multicluster Global Hub",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:multicluster_globalhub"
            ],
            "defaultStatus": "unaffected",
            "packageName": "multicluster-globalhub/multicluster-globalhub-agent-rhel9",
            "product": "Multicluster Global Hub",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:network_observ_optr:1"
            ],
            "defaultStatus": "unaffected",
            "packageName": "network-observability/network-observability-rhel9-operator",
            "product": "Network Observability Operator",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ocp_tools"
            ],
            "defaultStatus": "affected",
            "packageName": "helm",
            "product": "OpenShift Developer Tools and Services",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_lightspeed"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-lightspeed/lightspeed-rhel9-operator",
            "product": "OpenShift Lightspeed",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_pipelines:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-pipelines-client",
            "product": "OpenShift Pipelines",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "affected",
            "packageName": "kn-workflow-plugin",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift-golang-builder-container",
            "product": "OpenShift Service Mesh 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:2"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-service-mesh/pilot-rhel8",
            "product": "OpenShift Service Mesh 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:service_mesh:3"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-golang-builder-container",
            "product": "OpenShift Service Mesh 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_power_monitoring"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-power-monitoring/power-monitoring-rhel9-operator",
            "product": "Power monitoring for Red Hat OpenShift",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:acm:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhacm2/acm-governance-policy-addon-controller-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:acm:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhacm2/acm-governance-policy-framework-addon-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:acm:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhacm2/config-policy-controller-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:acm:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhacm2/governance-policy-propagator-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:acm:2"
            ],
            "defaultStatus": "affected",
            "packageName": "rhacm2/klusterlet-addon-controller-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:acm:2"
            ],
            "defaultStatus": "affected",
            "packageName": "rhacm2/thanos-rhel9",
            "product": "Red Hat Advanced Cluster Management for Kubernetes 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "ansible-automation-platform/platform-operator-bundle",
            "product": "Red Hat Ansible Automation Platform 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "automation-gateway-proxy-openssl30",
            "product": "Red Hat Ansible Automation Platform 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_automation_platform:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "automation-gateway-proxy-openssl32",
            "product": "Red Hat Ansible Automation Platform 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ceph_storage:5"
            ],
            "defaultStatus": "unknown",
            "packageName": "rhceph/rhceph-5-dashboard-rhel8",
            "product": "Red Hat Ceph Storage 5",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ceph_storage:6"
            ],
            "defaultStatus": "unknown",
            "packageName": "rhceph/rhceph-6-dashboard-rhel9",
            "product": "Red Hat Ceph Storage 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ceph_storage:9"
            ],
            "defaultStatus": "unknown",
            "packageName": "rhceph/alloy-rhel10",
            "product": "Red Hat Ceph Storage 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:certifications:9"
            ],
            "defaultStatus": "affected",
            "packageName": "redhat-certification-preflight",
            "product": "Red Hat Certification Program for Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:edge_manager:1"
            ],
            "defaultStatus": "affected",
            "packageName": "flightctl",
            "product": "Red Hat Edge Manager 1",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:edge_manager:1"
            ],
            "defaultStatus": "affected",
            "packageName": "rhem/flightctl-api-rhel9",
            "product": "Red Hat Edge Manager 1",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "affected",
            "packageName": "gvisor-tap-vsock",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "affected",
            "packageName": "ignition",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "affected",
            "packageName": "podman",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "affected",
            "packageName": "rhel10/bootc-image-builder",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10"
            ],
            "defaultStatus": "affected",
            "packageName": "rhel10-eus/rhel-10.0-bootc-image-builder",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "buildah",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "unaffected",
            "packageName": "conmon",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "gvisor-tap-vsock",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "ignition",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "podman",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhel9/bootc-image-builder",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhel9-eus/rhel-9.6-bootc-image-builder",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "skopeo",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_ai:3"
            ],
            "defaultStatus": "unknown",
            "packageName": "golang",
            "product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:lightspeed_for_runtimes:1"
            ],
            "defaultStatus": "affected",
            "packageName": "rh-lightspeed-runtimes/runtimes-inventory-rhel9-operator",
            "product": "Red Hat Lightspeed for Runtimes Operator",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-ai-gateway-payload-processing-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-data-science-pipelines-argo-argoexec-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-kserve-llmisvc-controller-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhoai/odh-kueue-controller-rhel8",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhoai/odh-llm-d-inference-scheduler-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhoai/odh-llm-d-routing-sidecar-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-maas-api-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhoai/odh-mlflow-operator-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-ml-pipelines-api-server-v2-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-ml-pipelines-driver-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-ml-pipelines-launcher-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-ml-pipelines-persistenceagent-v2-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-ml-pipelines-scheduledworkflow-v2-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-model-controller-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-modelmesh-serving-controller-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhoai/odh-model-registry-operator-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhoai/odh-model-registry-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-model-serving-api-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_cluster_manager_cli:1"
            ],
            "defaultStatus": "affected",
            "packageName": "ocm-cli-clients/ocm-cli-rhel9",
            "product": "Red Hat OpenShift Cluster Manager CLI",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "conmon",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "ignition",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "affected",
            "packageName": "kata-containers",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift4/ose-node",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift4/ose-sdn-rhel7",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-golang-builder-container",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "podman",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "skopeo",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "ocs4/cephcsi-rhel8",
            "product": "Red Hat Openshift Data Foundation 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "odf4/cephcsi-rhel8",
            "product": "Red Hat Openshift Data Foundation 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "odf4/cephcsi-rhel9",
            "product": "Red Hat Openshift Data Foundation 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-cli-rhel9",
            "product": "Red Hat Openshift Data Foundation 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "odf4/odf-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:devworkspace"
            ],
            "defaultStatus": "affected",
            "packageName": "devworkspace/devworkspace-rhel9-operator",
            "product": "Red Hat OpenShift Dev Workspaces Operator",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_distributed_tracing:3"
            ],
            "defaultStatus": "affected",
            "packageName": "rhosdt/tempo-rhel9",
            "product": "Red Hat OpenShift distributed tracing 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:windows_machine_config"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift4-wincw/windows-machine-config-rhel9-operator",
            "product": "Red Hat OpenShift for Windows Containers",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_gitops:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-gitops-1/argocd-rhel8",
            "product": "Red Hat OpenShift GitOps",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_gitops:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-gitops-1/argocd-rhel9",
            "product": "Red Hat OpenShift GitOps",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:container_native_virtualization:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "container-native-virtualization/kubevirt-apiserver-proxy-rhel9",
            "product": "Red Hat OpenShift Virtualization 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:container_native_virtualization:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "container-native-virtualization/virt-api-rhel9",
            "product": "Red Hat OpenShift Virtualization 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:container_native_virtualization:4"
            ],
            "defaultStatus": "affected",
            "packageName": "kubevirt",
            "product": "Red Hat OpenShift Virtualization 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:container_native_virtualization:4"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-golang-builder-container",
            "product": "Red Hat OpenShift Virtualization 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:16.2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhosp-rhel8/osp-director-operator-bundle",
            "product": "Red Hat OpenStack Platform 16.2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:17.1"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhosp-rhel9/osp-director-operator-bundle",
            "product": "Red Hat OpenStack Platform 17.1",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openstack:18.0"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhoso-operators/ovn-rhel9-operator",
            "product": "Red Hat OpenStack Platform 18.0",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:quay:3"
            ],
            "defaultStatus": "affected",
            "packageName": "quay/quay-builder-rhel8",
            "product": "Red Hat Quay 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:satellite:6"
            ],
            "defaultStatus": "affected",
            "packageName": "satellite/iop-vmaas-rhel9",
            "product": "Red Hat Satellite 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:service_interconnect:1"
            ],
            "defaultStatus": "affected",
            "packageName": "skupper-cli",
            "product": "Red Hat Service Interconnect 1",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:service_interconnect:2"
            ],
            "defaultStatus": "affected",
            "packageName": "skupper-cli",
            "product": "Red Hat Service Interconnect 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_security_profiles_operator:1"
            ],
            "defaultStatus": "affected",
            "packageName": "compliance/openshift-security-profiles-rhel8-operator",
            "product": "Security Profiles Operator",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:zero_trust_workload_identity_manager:1"
            ],
            "defaultStatus": "affected",
            "packageName": "zero-trust-workload-identity-manager/spiffe-spire-agent-rhel9",
            "product": "Zero Trust Workload Identity Manager",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:zero_trust_workload_identity_manager:0"
            ],
            "defaultStatus": "affected",
            "packageName": "zero-trust-workload-identity-manager/spiffe-spire-agent-rhel9",
            "product": "Zero Trust Workload Identity Manager - Tech Preview",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-05-07T19:41:18.615Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in the `net/mail` package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the `consumePhrase` function, it can lead to excessive resource consumption due to quadratic string concatenation, resulting in a Denial of Service (DoS) condition."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-1046",
                "description": "Creation of Immutable Text Using String Concatenation",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-15T12:04:18.766Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-42499"
          },
          {
            "name": "RHBZ#2467809",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467809"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42499.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:50319"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:59830"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:56785"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:56910"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:56852"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:60018"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:57482"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:54552"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:50336"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:57845"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:57914"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:63636"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:49702"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:67517"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:65335"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:66327"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:63332"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:22120"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:63022"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:65534"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:65116"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:65895"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:64818"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:63163"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:22112"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:62407"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:67148"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:61253"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:62754"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:57649"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:62753"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:49712"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:51112"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:65336"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:62803"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:22121"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:62406"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:65886"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:65117"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:65153"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:54531"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:34364"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:56340"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:47952"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:50843"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:51033"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:59467"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:66022"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:43692"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36319"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36625"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36754"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:33574"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:17713"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:17714"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:41928"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:50300"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:43038"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:42644"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:60520"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:59833"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:56789"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:56912"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:56854"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:60023"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:57487"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:54555"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:54583"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:54602"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:62260"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:33120"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:33123"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:33142"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:33150"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:54287"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:54284"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:54286"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:54285"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:54274"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:54283"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:41031"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:42146"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:43052"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:42796"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:41066"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:40262"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36797"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:57194"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:50319: Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:59830: Red Hat OpenShift Container Platform 4.12"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:56785: Red Hat OpenShift Container Platform 4.14"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:56910: Red Hat OpenShift Container Platform 4.15"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:56852: Red Hat OpenShift Container Platform 4.16"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:60018: Red Hat OpenShift Container Platform 4.17"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:57482: Red Hat OpenShift Container Platform 4.18"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:54552: Red Hat OpenShift Container Platform 4.19"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:50336: Red Hat Ansible Automation Platform 2.6 for RHEL 9"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:57845: Red Hat OpenShift Container Platform 4.16"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:57914: Red Hat OpenShift Container Platform 4.18"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:63636: Red Hat OpenShift Container Platform 4.19"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:49702: Red Hat Enterprise Linux AppStream EUS (v. 10.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:67517: Red Hat Enterprise Linux AppStream EUS (v. 10.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:65335: Red Hat Enterprise Linux AppStream EUS (v. 10.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:66327: Red Hat Enterprise Linux AppStream EUS (v. 10.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:63332: Red Hat Enterprise Linux AppStream (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:22120: Red Hat Enterprise Linux AppStream (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:63022: Red Hat Enterprise Linux AppStream (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:65534: Red Hat Enterprise Linux AppStream (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:65116: Red Hat Enterprise Linux AppStream (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:65895: Red Hat Enterprise Linux AppStream (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:64818: Red Hat Enterprise Linux AppStream (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:63163: Red Hat Enterprise Linux AppStream (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:22112: Red Hat Enterprise Linux AppStream (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:62407: Red Hat Enterprise Linux AppStream (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:67148: Red Hat Enterprise Linux AppStream (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:61253: Red Hat Enterprise Linux AppStream E4S (v.9.2)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:62754: Red Hat Enterprise Linux AppStream E4S (v.9.2)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:57649: Red Hat Enterprise Linux AppStream E4S (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:62753: Red Hat Enterprise Linux AppStream E4S (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:49712: Red Hat Enterprise Linux AppStream EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:51112: Red Hat Enterprise Linux AppStream EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:65336: Red Hat Enterprise Linux AppStream EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:62803: Red Hat Enterprise Linux AppStream EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:22121: Red Hat Enterprise Linux AppStream (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:62406: Red Hat Enterprise Linux AppStream (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:65886: Red Hat Enterprise Linux AppStream (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:65117: Red Hat Enterprise Linux AppStream (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:65153: Red Hat Enterprise Linux AppStream (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:54531: Cert Manager support for Red Hat OpenShift release 1.19"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:34364: Logging Subsystem for Red Hat OpenShift 6.4"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:56340: Logging Subsystem for Red Hat OpenShift 6.5"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:47952: Logging for Red Hat OpenShift 6.2"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:50843: Logging for Red Hat OpenShift 6"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:51033: OpenShift API for Data Protection 1.3"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:59467: OpenShift API for Data Protection 1.4"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:66022: OpenShift API for Data Protection 1.5"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:43692: OpenShift API for Data Protection 1.6"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36319: Red Hat Advanced Cluster Security 4.9"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36625: Red Hat Advanced Cluster Security for Kubernetes 4.10"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36754: Red Hat Developer Hub 1.10"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:33574: Red Hat Developer Hub 1.9"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:17713: Red Hat Hardened Images"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:17714: Red Hat Hardened Images"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:41928: Red Hat Migration Toolkit 1.8"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:50300: Red Hat Migration Toolkit for Applications 8.1"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:43038: Red Hat Migration Toolkit for Applications 8.2"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:42644: Red Hat OpenShift AI 2.25"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:60520: Red Hat OpenShift AI 3.4"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:59833: Red Hat OpenShift Container Platform 4.12"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:56789: Red Hat OpenShift Container Platform 4.14"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:56912: Red Hat OpenShift Container Platform 4.15"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:56854: Red Hat OpenShift Container Platform 4.16"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:60023: Red Hat OpenShift Container Platform 4.17"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:57487: Red Hat OpenShift Container Platform 4.18"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:54555: Red Hat OpenShift Container Platform 4.19"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:54583: Red Hat OpenShift Container Platform 4.20"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:54602: Red Hat OpenShift Container Platform 4.21"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:62260: Red Hat OpenShift Dev Spaces 3.30"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:33120: Red Hat OpenShift Service Mesh 3.0"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:33123: Red Hat OpenShift Service Mesh 3.1"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:33142: Red Hat OpenShift Service Mesh 3.2"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:33150: Red Hat OpenShift Service Mesh 3.3"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:54287: Red Hat OpenShift Workload Availability 0.12"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:54284: Red Hat OpenShift Workload Availability 0.13"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:54286: Red Hat OpenShift Workload Availability 0.3"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:54285: Red Hat OpenShift Workload Availability 0.7"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:54274: Red Hat OpenShift Workload Availability 0.8"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:54283: Red Hat OpenShift Workload Availability 5.7"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:41031: Red Hat Quay 3.10"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:42146: Red Hat Quay 3.12"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:43052: Red Hat Quay 3.12"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:42796: Red Hat Quay 3.15"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:41066: Red Hat Quay 3.16"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:40262: Red Hat Quay 3.9"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36797: Red Hat Trusted Artifact Signer 1.4"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:57194: multicluster engine for Kubernetes 2.11"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-05-07T20:00:51.685Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-05-07T19:41:18.615Z",
            "value": "Made public."
          }
        ],
        "title": "net/mail: golang: net/mail: Denial of Service via pathological email address parsing",
        "workarounds": [
          {
            "lang": "en",
            "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "net/mail",
          "product": "net/mail",
          "programRoutines": [
            {
              "name": "addrParser.consumePhrase"
            },
            {
              "name": "AddressParser.Parse"
            },
            {
              "name": "AddressParser.ParseList"
            },
            {
              "name": "Header.AddressList"
            },
            {
              "name": "ParseAddress"
            },
            {
              "name": "ParseAddressList"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.25.10",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.26.3",
              "status": "affected",
              "version": "1.26.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-407: Inefficient Algorithmic Complexity",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-07T19:41:18.615Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/issue/78987"
        },
        {
          "url": "https://go.dev/cl/771520"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-4977"
        }
      ],
      "title": "Quadratic string concatenation in consumePhrase in net/mail"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2026-42499",
    "datePublished": "2026-05-07T19:41:18.615Z",
    "dateReserved": "2026-04-28T00:21:12.791Z",
    "dateUpdated": "2026-09-15T12:04:18.766Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-42502 (GCVE-0-2026-42502)

Vulnerability from cvelistv5 – Published: 2026-05-22 15:01 – Updated: 2026-05-22 17:17

Title

Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html

Summary

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-22 17:16 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

Go Google root

References

4 references

URL	Tags
https://go.dev/issue/79572
https://groups.google.com/g/golang-announce/c/iI-…
https://go.dev/cl/781701
https://pkg.go.dev/vuln/GO-2026-5027

Impacted products

1 product

Vendor	Product	Version
golang.org/x/net	golang.org/x/net/html	Affected: 0 , < 0.55.0 (semver)

Credits

Tristan Madani

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.1,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-42502",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-22T17:16:33.414557Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-22T17:17:20.637Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "golang.org/x/net/html",
          "product": "golang.org/x/net/html",
          "programRoutines": [
            {
              "name": "parser.parse"
            },
            {
              "name": "Parse"
            },
            {
              "name": "ParseFragment"
            },
            {
              "name": "ParseFragmentWithOptions"
            },
            {
              "name": "ParseWithOptions"
            }
          ],
          "vendor": "golang.org/x/net",
          "versions": [
            {
              "lessThan": "0.55.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Tristan Madani"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-22T15:01:21.649Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/issue/79572"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8"
        },
        {
          "url": "https://go.dev/cl/781701"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-5027"
        }
      ],
      "title": "Invoking  incorrect handling of HTML elements in foreign content in golang.org/x/net/html"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2026-42502",
    "datePublished": "2026-05-22T15:01:21.649Z",
    "dateReserved": "2026-04-28T00:21:12.791Z",
    "dateUpdated": "2026-05-22T17:17:20.637Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-56853 (GCVE-0-2026-56853)

Vulnerability from cvelistv5 – Published: 2026-08-13 21:58 – Updated: 2026-08-14 15:23

Title

Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http

Summary

When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-14 15:22 UTC

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

Go Google root

References

4 references

URL	Tags
https://go.dev/issue/80205
https://go.dev/cl/795540
https://groups.google.com/g/golang-announce/c/94p…
https://pkg.go.dev/vuln/GO-2026-6089

Impacted products

1 product

Vendor	Product	Version
Go standard library	net/http	Affected: 0 , < 1.25.13 (semver) Affected: 1.26.0-0 , < 1.26.6 (semver) Affected: 1.27.0-0 , < 1.27.0-rc.3 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-56853",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-14T15:22:45.475320Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-770",
                "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-14T15:23:18.680Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "net/http",
          "product": "net/http",
          "programRoutines": [
            {
              "name": "conn.readRequest"
            },
            {
              "name": "conn.serve"
            },
            {
              "name": "ListenAndServe"
            },
            {
              "name": "ListenAndServeTLS"
            },
            {
              "name": "Serve"
            },
            {
              "name": "ServeTLS"
            },
            {
              "name": "Server.ListenAndServe"
            },
            {
              "name": "Server.ListenAndServeTLS"
            },
            {
              "name": "Server.Serve"
            },
            {
              "name": "Server.ServeTLS"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.25.13",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.26.6",
              "status": "affected",
              "version": "1.26.0-0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.27.0-rc.3",
              "status": "affected",
              "version": "1.27.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-13T21:58:53.092Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/issue/80205"
        },
        {
          "url": "https://go.dev/cl/795540"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-6089"
        }
      ],
      "title": "Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2026-56853",
    "datePublished": "2026-08-13T21:58:53.092Z",
    "dateReserved": "2026-06-23T15:10:49.352Z",
    "dateUpdated": "2026-08-14T15:23:18.680Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-56858 (GCVE-0-2026-56858)

Vulnerability from cvelistv5 – Published: 2026-08-13 21:58 – Updated: 2026-08-14 15:32

Title

Fix Javascript regexp context tracking in html/template

Summary

Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-14 15:31 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

Go Google root

References

4 references

URL	Tags
https://go.dev/issue/80435
https://go.dev/cl/807100
https://groups.google.com/g/golang-announce/c/94p…
https://pkg.go.dev/vuln/GO-2026-6091

Impacted products

1 product

Vendor	Product	Version
Go standard library	html/template	Affected: 0 , < 1.25.13 (semver) Affected: 1.26.0-0 , < 1.26.6 (semver) Affected: 1.27.0-0 , < 1.27.0-rc.3 (semver)

Credits

Ali Sherif

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.1,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-56858",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-14T15:31:30.140536Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-79",
                "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-14T15:32:29.852Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "html/template",
          "product": "html/template",
          "programRoutines": [
            {
              "name": "tJS"
            },
            {
              "name": "Template.Execute"
            },
            {
              "name": "Template.ExecuteTemplate"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.25.13",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.26.6",
              "status": "affected",
              "version": "1.26.0-0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.27.0-rc.3",
              "status": "affected",
              "version": "1.27.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Ali Sherif"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Previously, pathological inputs could close an unescaped \u0027/\u0027 early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-13T21:58:53.354Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/issue/80435"
        },
        {
          "url": "https://go.dev/cl/807100"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-6091"
        }
      ],
      "title": "Fix Javascript regexp context tracking in html/template"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2026-56858",
    "datePublished": "2026-08-13T21:58:53.354Z",
    "dateReserved": "2026-06-23T15:10:49.353Z",
    "dateUpdated": "2026-08-14T15:32:29.852Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-56859 (GCVE-0-2026-56859)

Vulnerability from cvelistv5 – Published: 2026-08-13 21:58 – Updated: 2026-08-14 15:21

Title

Add recursion depth guard during decode in encoding/xml

Summary

Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-14 15:21 UTC

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

Go Google root

References

4 references

URL	Tags
https://go.dev/issue/80481
https://go.dev/cl/803320
https://groups.google.com/g/golang-announce/c/94p…
https://pkg.go.dev/vuln/GO-2026-6088

Impacted products

1 product

Vendor	Product	Version
Go standard library	encoding/xml	Affected: 0 , < 1.25.13 (semver) Affected: 1.26.0-0 , < 1.26.6 (semver) Affected: 1.27.0-0 , < 1.27.0-rc.3 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-56859",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-14T15:21:09.615961Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-770",
                "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-14T15:21:46.218Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "encoding/xml",
          "product": "encoding/xml",
          "programRoutines": [
            {
              "name": "Decoder.push"
            },
            {
              "name": "Decoder.pop"
            },
            {
              "name": "Decoder.RawToken"
            },
            {
              "name": "Decoder.unmarshalPath"
            },
            {
              "name": "Decoder.unmarshal"
            },
            {
              "name": "Decoder.Decode"
            },
            {
              "name": "Decoder.DecodeElement"
            },
            {
              "name": "Decoder.Skip"
            },
            {
              "name": "Decoder.Token"
            },
            {
              "name": "Unmarshal"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.25.13",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.26.6",
              "status": "affected",
              "version": "1.26.0-0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.27.0-rc.3",
              "status": "affected",
              "version": "1.27.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-13T21:58:52.959Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/issue/80481"
        },
        {
          "url": "https://go.dev/cl/803320"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-6088"
        }
      ],
      "title": "Add recursion depth guard during decode in encoding/xml"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2026-56859",
    "datePublished": "2026-08-13T21:58:52.959Z",
    "dateReserved": "2026-06-23T15:10:49.353Z",
    "dateUpdated": "2026-08-14T15:21:46.218Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-56860 (GCVE-0-2026-56860)

Vulnerability from cvelistv5 – Published: 2026-08-13 21:58 – Updated: 2026-08-14 16:14

Title

Avoid quadratic complexity in resolvePath in net/url

Summary

Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations.

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-14 16:14 UTC

CWE

CWE-407 - Inefficient Algorithmic Complexity

Assigner

Go Google root

References

4 references

URL	Tags
https://go.dev/cl/803681
https://go.dev/issue/80494
https://groups.google.com/g/golang-announce/c/94p…
https://pkg.go.dev/vuln/GO-2026-6218

Impacted products

1 product

Vendor	Product	Version
Go standard library	net/url	Affected: 0 , < 1.25.13 (semver) Affected: 1.26.0-0 , < 1.26.6 (semver) Affected: 1.27.0-0 , < 1.27.0-rc.3 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 5.9,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-56860",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-14T16:14:34.601382Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-407",
                "description": "CWE-407 Inefficient Algorithmic Complexity",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-14T16:14:39.166Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "net/url",
          "product": "net/url",
          "programRoutines": [
            {
              "name": "resolvePath"
            },
            {
              "name": "URL.Parse"
            },
            {
              "name": "URL.ResolveReference"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.25.13",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.26.6",
              "status": "affected",
              "version": "1.26.0-0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.27.0-rc.3",
              "status": "affected",
              "version": "1.27.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Previously, resolving relative paths containing parent directory (\u0027..\u0027) segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for \u0027..\u0027 segments, eliminating the quadratic time complexity and significantly reducing memory allocations."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-407: Inefficient Algorithmic Complexity",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-13T21:58:53.731Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/cl/803681"
        },
        {
          "url": "https://go.dev/issue/80494"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-6218"
        }
      ],
      "title": "Avoid quadratic complexity in resolvePath in net/url"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2026-56860",
    "datePublished": "2026-08-13T21:58:53.731Z",
    "dateReserved": "2026-06-23T15:10:49.353Z",
    "dateUpdated": "2026-08-14T16:14:39.166Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-56862 (GCVE-0-2026-56862)

Vulnerability from cvelistv5 – Published: 2026-08-13 21:58 – Updated: 2026-08-14 15:29

Title

Limit handshake messages we are willing to accept post-handshake in crypto/tls

Summary

Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-14 15:27 UTC

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

Go Google root

References

4 references

URL	Tags
https://go.dev/issue/80528
https://go.dev/cl/804261
https://groups.google.com/g/golang-announce/c/94p…
https://pkg.go.dev/vuln/GO-2026-6090

Impacted products

1 product

Vendor	Product	Version
Go standard library	crypto/tls	Affected: 0 , < 1.25.13 (semver) Affected: 1.26.0-0 , < 1.26.6 (semver) Affected: 1.27.0-0 , < 1.27.0-rc.3 (semver)

Credits

Qi Deng of Aurascape.ai

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-56862",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-14T15:27:34.651997Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-770",
                "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-14T15:29:41.741Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "crypto/tls",
          "product": "crypto/tls",
          "programRoutines": [
            {
              "name": "Conn.readRecordOrCCS"
            },
            {
              "name": "Conn.Handshake"
            },
            {
              "name": "Conn.HandshakeContext"
            },
            {
              "name": "Conn.Read"
            },
            {
              "name": "Conn.Write"
            },
            {
              "name": "Dial"
            },
            {
              "name": "DialWithDialer"
            },
            {
              "name": "Dialer.Dial"
            },
            {
              "name": "Dialer.DialContext"
            },
            {
              "name": "QUICConn.HandleData"
            },
            {
              "name": "QUICConn.Start"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.25.13",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.26.6",
              "status": "affected",
              "version": "1.26.0-0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.27.0-rc.3",
              "status": "affected",
              "version": "1.27.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Qi Deng of Aurascape.ai"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-13T21:58:53.216Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/issue/80528"
        },
        {
          "url": "https://go.dev/cl/804261"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-6090"
        }
      ],
      "title": "Limit handshake messages we are willing to accept post-handshake in crypto/tls"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2026-56862",
    "datePublished": "2026-08-13T21:58:53.216Z",
    "dateReserved": "2026-06-23T15:10:49.353Z",
    "dateUpdated": "2026-08-14T15:29:41.741Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-8609 (GCVE-0-2026-8609)

Vulnerability from cvelistv5 – Published: 2026-07-10 14:58 – Updated: 2026-08-27 17:22

Title

Pre-authentication denial of service via the OAuth login route

Summary

An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique values, causing unbounded memory growth that can eventually exhaust memory and crash the Grafana instance (denial of service).

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-10 15:53 UTC

CWE

CWE-400
CWE-400 - Uncontrolled Resource Consumption

Assigner

GRAFANA mitre root

References

1 reference

URL	Tags
https://grafana.com/security/security-advisories/…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
Grafana	Grafana OSS	Affected: 11.6.0 , ≤ 11.6.14 (semver) Affected: 12.2.0 , ≤ 12.2.8 (semver) Affected: 12.3.0 , ≤ 12.3.6 (semver) Affected: 12.4.0 , ≤ 12.4.3 (semver) Affected: 13.0.0 , ≤ 13.0.1 (semver)

Date Public

2026-06-09 00:00

Credits

cyberjoker (Researcher)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-8609",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-10T15:53:40.169487Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-400",
                "description": "CWE-400 Uncontrolled Resource Consumption",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-10T15:53:51.365Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Grafana OSS",
          "vendor": "Grafana",
          "versions": [
            {
              "lessThanOrEqual": "11.6.14",
              "status": "affected",
              "version": "11.6.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.2.8",
              "status": "affected",
              "version": "12.2.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.3.6",
              "status": "affected",
              "version": "12.3.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "12.4.3",
              "status": "affected",
              "version": "12.4.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "13.0.1",
              "status": "affected",
              "version": "13.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "cyberjoker (Researcher)"
        }
      ],
      "datePublic": "2026-06-09T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "An unauthenticated attacker can repeatedly call Grafana\u0027s OAuth login route with unique values, causing unbounded memory growth that can eventually exhaust memory and crash the Grafana instance (denial of service)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T17:22:37.575Z",
        "orgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
        "shortName": "GRAFANA"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://grafana.com/security/security-advisories/cve-2026-8609"
        }
      ],
      "source": {
        "discovery": "BUG_BOUNTY"
      },
      "title": "Pre-authentication denial of service via the OAuth login route",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "57da9224-a3e2-4646-9d0e-c4dc2e05e7da",
    "assignerShortName": "GRAFANA",
    "cveId": "CVE-2026-8609",
    "datePublished": "2026-07-10T14:58:33.522Z",
    "dateReserved": "2026-05-14T16:01:42.297Z",
    "dateUpdated": "2026-08-27T17:22:37.575Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2026:67517

CVE-2026-42127 (GCVE-0-2026-42127)

CVE-2026-42499 (GCVE-0-2026-42499)

CVE-2026-42502 (GCVE-0-2026-42502)

CVE-2026-56853 (GCVE-0-2026-56853)

CVE-2026-56858 (GCVE-0-2026-56858)

CVE-2026-56859 (GCVE-0-2026-56859)

CVE-2026-56860 (GCVE-0-2026-56860)

CVE-2026-56862 (GCVE-0-2026-56862)

CVE-2026-8609 (GCVE-0-2026-8609)

Tags

Sightings

Nomenclature

Related by attack behaviour