{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Hardened Images RPMs is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This update includes the following RPMs:\n\ngrafana13.2:\n  * grafana13.2-13.2.3-0.1.hum1 (aarch64, x86_64)\n  * grafana13.2-13.2.3-0.1.hum1.src (src)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:76430",
        "url": "https://access.redhat.com/errata/RHSA-2026:76430"
      },
      {
        "category": "external",
        "summary": "https://images.redhat.com/",
        "url": "https://images.redhat.com/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-13720",
        "url": "https://access.redhat.com/security/cve/CVE-2026-13720"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-13719",
        "url": "https://access.redhat.com/security/cve/CVE-2026-13719"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-81841",
        "url": "https://access.redhat.com/security/cve/CVE-2026-81841"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-76154",
        "url": "https://access.redhat.com/security/cve/CVE-2026-76154"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-56851",
        "url": "https://access.redhat.com/security/cve/CVE-2026-56851"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-61801",
        "url": "https://access.redhat.com/security/cve/CVE-2026-61801"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2024-24786",
        "url": "https://access.redhat.com/security/cve/CVE-2024-24786"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-101899",
        "url": "https://access.redhat.com/security/cve/CVE-2026-101899"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-97394",
        "url": "https://access.redhat.com/security/cve/CVE-2026-97394"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_76430.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
    "tracking": {
      "current_release_date": "2026-10-30T09:22:59+00:00",
      "generator": {
        "date": "2026-10-30T09:22:59+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.3"
        }
      },
      "id": "RHSA-2026:76430",
      "initial_release_date": "2026-10-05T22:17:42+00:00",
      "revision_history": [
        {
          "date": "2026-10-05T22:17:42+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-10-16T09:18:42+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-10-30T09:22:59+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Hardened Images",
                "product": {
                  "name": "Red Hat Hardened Images",
                  "product_id": "Red Hat Hardened Images",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:hummingbird:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Hardened Images"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana13.2-0:13.2.3-0.1.hum1@aarch64",
                "product": {
                  "name": "grafana13.2-0:13.2.3-0.1.hum1@aarch64",
                  "product_id": "grafana13.2-0:13.2.3-0.1.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana13.2@13.2.3-0.1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana13.2-0:13.2.3-0.1.hum1@src",
                "product": {
                  "name": "grafana13.2-0:13.2.3-0.1.hum1@src",
                  "product_id": "grafana13.2-0:13.2.3-0.1.hum1@src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana13.2@13.2.3-0.1.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "grafana13.2-0:13.2.3-0.1.hum1@x86_64",
                "product": {
                  "name": "grafana13.2-0:13.2.3-0.1.hum1@x86_64",
                  "product_id": "grafana13.2-0:13.2.3-0.1.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/grafana13.2@13.2.3-0.1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana13.2-0:13.2.3-0.1.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@aarch64"
        },
        "product_reference": "grafana13.2-0:13.2.3-0.1.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana13.2-0:13.2.3-0.1.hum1@src as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@src"
        },
        "product_reference": "grafana13.2-0:13.2.3-0.1.hum1@src",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "grafana13.2-0:13.2.3-0.1.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@x86_64"
        },
        "product_reference": "grafana13.2-0:13.2.3-0.1.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-24786",
      "cwe": {
        "id": "CWE-835",
        "name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
      },
      "discovery_date": "2024-03-06T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2268046"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in golang-protobuf. The protojson unmarshaling function can enter an infinite loop when parsing certain invalid JSON inputs, specifically when decoding messages containing Any values or when configured to discard unknown fields. A remote attacker can exploit this vulnerability by submitting specially crafted JSON payloads to cause excessive CPU utilization and hang the application, resulting in a Denial of Service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "google.golang.org/protobuf: golang-protobuf: Denial of Service via infinite loop when unmarshaling invalid JSON",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Moderate impact because exploitation is restricted to denial of service via excessive CPU and thread consumption, without compromising data confidentiality or system integrity. Red Hat services and containerized components are only exposed if they process untrusted JSON inputs into Protocol Buffer structures configured with specific parsing behaviors. Under typical deployments, the flaw does not grant privileged access or permit arbitrary code execution.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@aarch64",
          "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@src",
          "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2024-24786"
        },
        {
          "category": "external",
          "summary": "RHBZ#2268046",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2268046"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2024-24786",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-24786"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2024-24786",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24786"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/569356",
          "url": "https://go.dev/cl/569356"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/ArQ6CDgtEjY/",
          "url": "https://groups.google.com/g/golang-announce/c/ArQ6CDgtEjY/"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2024-2611",
          "url": "https://pkg.go.dev/vuln/GO-2024-2611"
        }
      ],
      "release_date": "2024-03-05T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-05T22:17:42+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@src",
            "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:76430"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@src",
            "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@src",
            "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "google.golang.org/protobuf: golang-protobuf: Denial of Service via infinite loop when unmarshaling invalid JSON"
    },
    {
      "cve": "CVE-2026-13719",
      "cwe": {
        "id": "CWE-863",
        "name": "Incorrect Authorization"
      },
      "discovery_date": "2026-09-30T11:21:02.069718+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2543885"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Grafana. An authenticated user can query the alert rules list Application Programming Interface (API) to access alert rules stored in restricted folders they lack permission to read. When access restrictions are evaluated and a user has no readable folders, folder filtering is dropped and all alert rules within the organization are returned. This flaw results in unauthorized information disclosure of alert rule configurations, though data source credentials are not exposed.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "github.com/grafana/grafana: Grafana: Information disclosure via alert rules list API",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate impact flaw allows an authenticated Grafana user to retrieve alert-rule configurations from folders they cannot read by querying the alert-rule list API. Disclosure is limited to the organization\u2019s rule configurations; data source credentials are not exposed. Red Hat products shipping Grafana builds with the vulnerable behavior are affected.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@aarch64",
          "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@src",
          "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-13719"
        },
        {
          "category": "external",
          "summary": "RHBZ#2543885",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543885"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-13719",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-13719"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-13719",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13719"
        },
        {
          "category": "external",
          "summary": "https://grafana.com/security/security-advisories/cve-2026-13719",
          "url": "https://grafana.com/security/security-advisories/cve-2026-13719"
        }
      ],
      "release_date": "2026-09-30T11:06:38.172000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-05T22:17:42+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@src",
            "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:76430"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@src",
            "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@src",
            "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "github.com/grafana/grafana: Grafana: Information disclosure via alert rules list API"
    },
    {
      "cve": "CVE-2026-13720",
      "cwe": {
        "id": "CWE-915",
        "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
      },
      "discovery_date": "2026-09-30T11:21:20.830493+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2543886"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Grafana. An authenticated user with Editor permissions can set file-provisioning metadata when creating a dashboard through the dashboard API due to a missing authorization check. Consequently, the dashboard is treated as externally managed by configuration files, preventing administrators from modifying or deleting it through the Grafana web interface. The impact is restricted to the editor\u0027s organization and does not expose sensitive data.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "grafana: grafana: Dashboard modification lockout via forged file-provisioning metadata",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@aarch64",
          "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@src",
          "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-13720"
        },
        {
          "category": "external",
          "summary": "RHBZ#2543886",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543886"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-13720",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-13720"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-13720",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13720"
        },
        {
          "category": "external",
          "summary": "https://grafana.com/security/security-advisories/cve-2026-13720",
          "url": "https://grafana.com/security/security-advisories/cve-2026-13720"
        }
      ],
      "release_date": "2026-09-30T11:06:38.177000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-05T22:17:42+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@src",
            "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:76430"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@src",
            "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "grafana: grafana: Dashboard modification lockout via forged file-provisioning metadata"
    },
    {
      "cve": "CVE-2026-56851",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2026-10-07T18:01:23.622132+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2547607"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in golang.org/x/text. An attacker can cause a Denial of Service (DoS) by submitting specially crafted input to an application utilizing the Nickname profile. When transforming this input into an undersized destination buffer, an out-of-bounds slice indexing error occurs, causing the application to panic and crash.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang.org/x/text: golang.org/x/text: Denial of Service via out-of-bounds slice error in Nickname profile",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as an Important severity impact because unauthenticated network attackers could remotely crash affected services by causing an unhandled application panic, leading to a denial of service. While many Red Hat services and containerized components bundle Go standard and extended libraries, practical exposure is restricted to programs explicitly utilizing the PRECIS Nickname profile to normalize or validate user-provided strings against small memory buffers. Applications that do not handle user nicknames or those that allocate appropriately sized buffers for text transformation are not susceptible to this crash.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@aarch64",
          "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@src",
          "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56851"
        },
        {
          "category": "external",
          "summary": "RHBZ#2547607",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2547607"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56851",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56851"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56851",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56851"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/793360",
          "url": "https://go.dev/cl/793360"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80112",
          "url": "https://go.dev/issue/80112"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6629",
          "url": "https://pkg.go.dev/vuln/GO-2026-6629"
        }
      ],
      "release_date": "2026-10-07T17:46:35.620000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-05T22:17:42+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@src",
            "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:76430"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@src",
            "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "golang.org/x/text: golang.org/x/text: Denial of Service via out-of-bounds slice error in Nickname profile"
    },
    {
      "cve": "CVE-2026-61801",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-10-08T16:41:20.397001+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2548048"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the moby/sys/user package. The package does not properly limit memory allocation when parsing Unix-style user and group database files, such as /etc/passwd or /etc/group. An attacker who can supply a specially crafted file can cause excessive memory consumption, leading to a Denial of Service (DoS) condition by crashing the affected process.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "github.com/moby/sys/user: moby/sys/user: Denial of Service via crafted user or group database files",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Moderate impact because exploitation requires supplying a malicious user or group database file to an affected tool, and the resulting impact is limited to an out-of-memory denial of service without compromising confidentiality, integrity, or elevating privileges. Across Red Hat enterprise environments, container management utilities and orchestration platforms invoke these routines when inspecting filesystem layers or resolving identity information during container execution. While an attacker capable of providing a specially crafted database file could trigger resource exhaustion and terminate the consuming process, the flaw does not facilitate container escapes or host compromise.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@aarch64",
          "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@src",
          "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-61801"
        },
        {
          "category": "external",
          "summary": "RHBZ#2548048",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2548048"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-61801",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-61801"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-61801",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61801"
        },
        {
          "category": "external",
          "summary": "https://github.com/moby/sys/commit/85a71bbe1faa36c552a960e6a5f3d0cfb632fbbe",
          "url": "https://github.com/moby/sys/commit/85a71bbe1faa36c552a960e6a5f3d0cfb632fbbe"
        },
        {
          "category": "external",
          "summary": "https://github.com/moby/sys/pull/221",
          "url": "https://github.com/moby/sys/pull/221"
        },
        {
          "category": "external",
          "summary": "https://github.com/moby/sys/security/advisories/GHSA-mjcv-p78q-w5fw",
          "url": "https://github.com/moby/sys/security/advisories/GHSA-mjcv-p78q-w5fw"
        }
      ],
      "release_date": "2026-10-08T16:22:25.558000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-05T22:17:42+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@src",
            "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:76430"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@src",
            "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@src",
            "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "github.com/moby/sys/user: moby/sys/user: Denial of Service via crafted user or group database files"
    },
    {
      "cve": "CVE-2026-76154",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2026-09-03T13:36:32.244000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2528028"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Grafana. A user with an Editor role can exploit a stored cross-site scripting (XSS) vulnerability in the Geomap panel. This occurs because the Geomap panel loads map styles from a URL and inserts the style\u0027s attribution field into the page without proper sanitization. By controlling the map style, an attacker can execute arbitrary JavaScript in the browser of anyone viewing the dashboard. If an Organization Administrator views the dashboard, the attacker\u0027s script can elevate their own account to Organization Administrator, leading to privilege escalation and unauthorized access to organizational dashboards, data source configurations, and credentials.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "grafana: Stored cross-site scripting in the Geomap panel allows privilege escalation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Important: A stored cross-site scripting vulnerability in the Grafana Geomap panel allows an authenticated attacker with Editor privileges to escalate their privileges to Org Admin. This is due to unsanitized input in the MapLibre style base layer\u0027s attribution field, which can execute arbitrary JavaScript in an administrator\u0027s browser session when they view a crafted dashboard. The Geomap panel is enabled by default, requiring no special configuration for exploitation.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@aarch64",
          "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@src",
          "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-76154"
        },
        {
          "category": "external",
          "summary": "RHBZ#2528028",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528028"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-76154",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-76154"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-76154",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76154"
        }
      ],
      "release_date": "2026-09-30T12:36:52.071589+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-05T22:17:42+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@src",
            "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:76430"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, disable the Geomap plugin. This can be achieved by setting `disable_plugins = geomap` in the `[plugins]` section of the `grafana.ini` configuration file, or by setting the environment variable `GF_PLUGINS_DISABLE_PLUGINS=geomap`. A restart of the Grafana service is required for the changes to take effect. Disabling the plugin will remove the Geomap panel and may affect existing dashboards that utilize it.",
          "product_ids": [
            "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@src",
            "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@src",
            "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "grafana: Stored cross-site scripting in the Geomap panel allows privilege escalation"
    },
    {
      "cve": "CVE-2026-81841",
      "cwe": {
        "id": "CWE-862",
        "name": "Missing Authorization"
      },
      "discovery_date": "2026-09-29T20:41:44.158139+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2543644"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Grafana. This vulnerability allows information disclosure because pausing a shared dashboard fails to revoke access tokens for endpoints serving initialization data. An unauthenticated remote attacker possessing the link to a paused dashboard can exploit this flaw to retrieve sensitive data source configurations, potentially exposing stored credentials.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "grafana: grafana: Information disclosure via unrevoked access tokens in paused shared dashboards",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Moderate because exploitation is restricted to unauthorized information disclosure and requires prior knowledge of the specific URL for a publicly shared dashboard. In standard Red Hat product configurations, public dashboard sharing is not enabled by default, significantly limiting overall exposure. Even if an unauthenticated user obtains the link to a paused dashboard, the impact is confined to viewing frontend bootstrap configurations and exposed data source details rather than enabling write privileges or host compromise.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@aarch64",
          "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@src",
          "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-81841"
        },
        {
          "category": "external",
          "summary": "RHBZ#2543644",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543644"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-81841",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-81841"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-81841",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-81841"
        },
        {
          "category": "external",
          "summary": "https://grafana.com/security/security-advisories/cve-2026-81841",
          "url": "https://grafana.com/security/security-advisories/cve-2026-81841"
        }
      ],
      "release_date": "2026-09-29T20:35:57.152000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-05T22:17:42+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@src",
            "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:76430"
        },
        {
          "category": "workaround",
          "details": "To mitigate this flaw without disabling features, permanently delete public shared dashboards rather than pausing them, which immediately revokes the associated access token.\n\nAlternatively, disable the public dashboard capability entirely by setting the following in `/etc/grafana/grafana.ini`:\n\n```ini\n[public_dashboards]\nenabled = false\n```\n\nOr configure the corresponding environment variable:\n`GF_PUBLIC_DASHBOARDS_ENABLED=false`\n\nApply the configuration by restarting the service:\n```bash\nsystemctl restart grafana-server\n```\n\nWarning: Restarting the `grafana-server` service will cause a brief interruption in service availability. Disabling public dashboards will prevent all unauthenticated access and sharing of dashboards across the environment.",
          "product_ids": [
            "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@src",
            "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@src",
            "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "grafana: grafana: Information disclosure via unrevoked access tokens in paused shared dashboards"
    },
    {
      "cve": "CVE-2026-97394",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "discovery_date": "2026-10-15T15:45:59.705582+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2553575"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in kin-openapi\u0027s openapi3filter module. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by crashing the application. The issue occurs when processing OpenAPI 3.1 array schemas that lack an items definition, causing the parser to encounter an unhandled null pointer while decoding form-encoded or multipart request bodies and response headers. An attacker can exploit this condition by submitting a crafted request to an affected endpoint, resulting in unexpected service termination.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "github.com/getkin/kin-openapi: kin-openapi: Denial of Service via nil-pointer dereference in openapi3filter",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat has evaluated this vulnerability as having an Important severity rating because an unauthenticated remote attacker can deterministically trigger an application crash, resulting in denial of service. The issue specifically impacts environments where incoming network traffic is validated against OpenAPI 3.1 definitions containing array schemas that omit item specifications during multipart or URL-encoded form handling. Deployments utilizing OpenAPI 3.0 or those strictly handling JSON-formatted request bodies remain unaffected by this defect.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@aarch64",
          "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@src",
          "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-97394"
        },
        {
          "category": "external",
          "summary": "RHBZ#2553575",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553575"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-97394",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-97394"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-97394",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97394"
        },
        {
          "category": "external",
          "summary": "https://github.com/getkin/kin-openapi/commit/30e292371a89ca6d1f91a9553e0aa518b49f838d",
          "url": "https://github.com/getkin/kin-openapi/commit/30e292371a89ca6d1f91a9553e0aa518b49f838d"
        },
        {
          "category": "external",
          "summary": "https://github.com/getkin/kin-openapi/releases/tag/v0.143.0",
          "url": "https://github.com/getkin/kin-openapi/releases/tag/v0.143.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/getkin/kin-openapi/security/advisories/GHSA-p6wj-qrr4-pgh5",
          "url": "https://github.com/getkin/kin-openapi/security/advisories/GHSA-p6wj-qrr4-pgh5"
        }
      ],
      "release_date": "2026-10-15T15:29:05.238000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-05T22:17:42+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@src",
            "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:76430"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@src",
            "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "github.com/getkin/kin-openapi: kin-openapi: Denial of Service via nil-pointer dereference in openapi3filter"
    },
    {
      "cve": "CVE-2026-101899",
      "cwe": {
        "id": "CWE-1025",
        "name": "Comparison Using Wrong Factors"
      },
      "discovery_date": "2026-10-13T16:01:53.491379+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2550659"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Axios. This vulnerability allows information disclosure when network traffic intended to bypass a proxy is improperly routed through it. Axios fails to parse Classless Inter-Domain Routing (CIDR) notation in proxy bypass lists as IP address ranges, treating them as plain text hostnames instead. As a result, an adversary with access to the configured proxy server can intercept or inspect sensitive request data and connection metadata intended for internal network services.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "axios: Axios: Information disclosure via improper CIDR proxy bypass handling",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A moderate information disclosure vulnerability was found in Axios, a promise-based HTTP client for Node.js that Red Hat Hardened Images (Hummingbird) ships as a dependency of its grafana12.4, grafana13.1, and grafana13.2 container images. Axios evaluates Classless Inter-Domain Routing (CIDR) notation entries in NO_PROXY proxy-bypass lists as textual hostname suffixes instead of IP address ranges. When a request targets an address covered by a CIDR entry in NO_PROXY while a proxy is configured, the CIDR bypass rule fails to match and the request is sent through the configured proxy. As a result, an adversary with access to the configured proxy server can observe and modify URLs, headers, and bodies of plaintext HTTP traffic intended for internal network services, and can observe connection metadata and CONNECT requests for HTTPS traffic. Red Hat rated this flaw as moderate severity (CVSS 6.5), consistent with the upstream assessment of moderate severity (CVSS 6.9). The resolution of this issue in the affected Hardened Images streams is delegated to the Hummingbird image maintainers, and a fix has been delivered through the affected image streams.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@aarch64",
          "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@src",
          "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-101899"
        },
        {
          "category": "external",
          "summary": "RHBZ#2550659",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2550659"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-101899",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-101899"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-101899",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101899"
        },
        {
          "category": "external",
          "summary": "https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a",
          "url": "https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a"
        },
        {
          "category": "external",
          "summary": "https://github.com/axios/axios/pull/11141",
          "url": "https://github.com/axios/axios/pull/11141"
        },
        {
          "category": "external",
          "summary": "https://github.com/axios/axios/releases/tag/v1.20.0",
          "url": "https://github.com/axios/axios/releases/tag/v1.20.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/axios/axios/security/advisories/GHSA-44g4-m2mj-wpvx",
          "url": "https://github.com/axios/axios/security/advisories/GHSA-44g4-m2mj-wpvx"
        }
      ],
      "release_date": "2026-10-13T15:49:51.223000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-05T22:17:42+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@src",
            "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:76430"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. The affected Red Hat Hardened Images releases containing the fix have been delivered; update to the latest grafana12.4, grafana13.1, and grafana13.2 image releases to resolve this issue.",
          "product_ids": [
            "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@src",
            "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@aarch64",
            "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@src",
            "Red Hat Hardened Images:grafana13.2-0:13.2.3-0.1.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "axios: Axios: Information disclosure via improper CIDR proxy bypass handling"
    }
  ]
}