RHSA-2026:88199

Vulnerability from csaf_redhat - Published: 2026-10-22 12:16 - Updated: 2026-11-05 13:15
Summary
Red Hat Security Advisory: LVMS 4.12 Bug Fix and Enhancement update
Severity
Important
Notes
Topic: Updated container images that fix multiple bugs are now available for LVMS 4.12
Details: After a successful LVMS upgrade, the latest lvms-operator SHA image should be running. This erratum implements the following changes: - Golang version bump to address CVE-2025-68121, CVE-2026-32280, CVE-2026-33811, CVE-2026-42504, CVE-2026-56860, CVE-2026-56859, CVE-2026-56862, CVE-2026-33818 Users of LVMS are advised to upgrade to the latest version in OpenShift Container Platform, which fixes these bugs and adds these enhancements.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
CVE-2025-68121

A flaw was found in the crypto/tls component. This vulnerability occurs during Transport Layer Security (TLS) session resumption when certificate authority (CA) settings are modified between the initial and resumed handshakes. An attacker could exploit this to bypass certificate validation, allowing a client or server to establish a connection that should have been rejected. This could lead to an authentication bypass under specific conditions.

7.4 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE-295 - Improper Certificate Validation
Affected products
Product Identifier Version Remediation
Unresolved product id: Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:0e5b2b2c9e36eb7604976e556aad35245a3254e60e5f258fde028ba8c17ef643_amd64 —
Vendor Fix fix
Workaround
Unresolved product id: Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:2089cc8e6c235795da7a00f7e97a9728457b990148bae4f50814b856cf16e52d_s390x —
Vendor Fix fix
Workaround
Unresolved product id: Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:561e7ea7f530d6a07f70844dd7f88cfe22a3007879b607204fa1402257769e96_ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:ff47e0294472c280c372ffb6b264bb8dac2a79354b9a55f704a9eca145722e94_arm64 —
Vendor Fix fix
Workaround
Product Identifier Version Remediation
Unresolved product id: Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:46bfe8b830548a0f8c2bd5908f569dabd9bf0b2df0f444ac90c9f196b08e7526_arm64 —
Workaround
Unresolved product id: Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:944c9e33b240ab584ffc67bf0421ab56defa359ca2261b5b4e8ec45b134c859e_s390x —
Workaround
Unresolved product id: Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:aeedd116f439373b0ffd779d383a8139e3aa6c2465a81a99d31ed485f93c7136_ppc64le —
Workaround
Unresolved product id: Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:b8fca1683e03e5c2f3a981f8f3b7e41fcbd5376d81a24819f9af9a654cbfe0d8_amd64 —
Workaround
Unresolved product id: Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-operator-bundle@sha256:62efb19ba31393591b35485e779aa0d28b5e038d5007159bf2a5f92f0ec813d5_amd64 —
Workaround
Unresolved product id: Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:57dcfc35580789fffea3095951537def03dc36d6bd99bb7f59c459920cb46a3c_amd64 —
Workaround
Unresolved product id: Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:58201e92b1db47183d2f8c41c08dbe256d4180cb64d84a63a0637ea556fc2a99_ppc64le —
Workaround
Unresolved product id: Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:5f0847d9942e1091f48cab27db5f6350e07c0645b9b154141d98aac630d51f0b_s390x —
Workaround
Unresolved product id: Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:639f7535378635b9116ff6fa387ff07c20caa72d32173fd22b3cbcc8d670b353_arm64 —
Workaround
Threats
Impact Moderate
CVE-2026-32280

A flaw was found in the Go standard library packages `crypto/x509` and `crypto/tls`. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being performed. This can result in a denial of service (DoS) condition, making the affected system or application unavailable to legitimate users.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 4 products, the same list as for CVE-2025-68121
Known not affected 9 products, the same list as for CVE-2025-68121
Threats
Impact Important
CVE-2026-33811

A flaw was found in the `net` package of Go (golang), specifically when using the `LookupCNAME` function with the `cgo` DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name (CNAME) response. This can trigger a double-free of C memory, leading to a crash and a Denial of Service (DoS) for the affected application.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-1341 - Multiple Releases of Same Resource or Handle
Affected products
Fixed 4 products, the same list as for CVE-2025-68121
Known not affected 9 products, the same list as for CVE-2025-68121
Threats
Impact Important
CVE-2026-33818

A flaw was found in the `encoding/asn1` package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One (ASN.1) structure, leading to excessive recursion during the `Unmarshal` operation. This could result in stack exhaustion and a Denial of Service (DoS) condition.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-776 - Improper Restriction of Recursive Entity References in DTDs
Affected products
Fixed 4 products, the same list as for CVE-2025-68121
Known not affected 9 products, the same list as for CVE-2025-68121
Threats
Impact Important
CVE-2026-42504

A flaw was found in the Golang MIME (Multipurpose Internet Mail Extensions) package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service (DoS) for the affected system.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-1050 - Excessive Platform Resource Consumption within a Loop
Affected products
Fixed 4 products, the same list as for CVE-2025-68121
Known not affected 9 products, the same list as for CVE-2025-68121
Threats
Impact Important
CVE-2026-56859

A flaw was found in the `encoding/xml` package of Go. The `DecodeElement` function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service (DoS) for the affected application.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-776 - Improper Restriction of Recursive Entity References in DTDs
Affected products
Fixed 4 products, the same list as for CVE-2025-68121
Known not affected 9 products, the same list as for CVE-2025-68121
Threats
Impact Important
CVE-2026-56860

A flaw was found in `net/url`, a component of `golang`. This vulnerability arises when resolving relative paths that contain numerous parent directory ('..') segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory allocation. This can result in a Denial of Service (DoS) due to resource exhaustion.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 4 products, the same list as for CVE-2025-68121
Known not affected 9 products, the same list as for CVE-2025-68121
Threats
Impact Important
CVE-2026-56862

A flaw was found in the `crypto/tls` package, part of `golang`. A malicious client can exploit this vulnerability by continuously sending KeyUpdate messages to a server. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service (DoS) condition.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-1050 - Excessive Platform Resource Consumption within a Loop
Affected products
Fixed 4 products, the same list as for CVE-2025-68121
Known not affected 9 products, the same list as for CVE-2025-68121
Threats
Impact Important
References
URL Category
https://access.redhat.com/errata/RHSA-2026:88199 self
https://access.redhat.com/security/cve/CVE-2025-68121 external
https://access.redhat.com/security/cve/CVE-2026-32280 external
https://access.redhat.com/security/cve/CVE-2026-33811 external
https://access.redhat.com/security/cve/CVE-2026-33818 external
https://access.redhat.com/security/cve/CVE-2026-42504 external
https://access.redhat.com/security/cve/CVE-2026-56859 external
https://access.redhat.com/security/cve/CVE-2026-56860 external
https://access.redhat.com/security/cve/CVE-2026-56862 external
https://access.redhat.com/security/updates/classi… external
https://security.access.redhat.com/data/csaf/v2/a… self
https://access.redhat.com/security/cve/CVE-2025-68121 self
https://bugzilla.redhat.com/show_bug.cgi?id=2437111 external
https://www.cve.org/CVERecord?id=CVE-2025-68121 external
https://nvd.nist.gov/vuln/detail/CVE-2025-68121 external
https://go.dev/cl/737700 external
https://go.dev/issue/77217 external
https://groups.google.com/g/golang-announce/c/K09… external
https://pkg.go.dev/vuln/GO-2026-4337 external
https://access.redhat.com/security/cve/CVE-2026-32280 self
https://bugzilla.redhat.com/show_bug.cgi?id=2456339 external
https://www.cve.org/CVERecord?id=CVE-2026-32280 external
https://nvd.nist.gov/vuln/detail/CVE-2026-32280 external
https://go.dev/cl/758320 external
https://go.dev/issue/78282 external
https://groups.google.com/g/golang-announce/c/0uY… external
https://pkg.go.dev/vuln/GO-2026-4947 external
https://access.redhat.com/security/cve/CVE-2026-33811 self
https://bugzilla.redhat.com/show_bug.cgi?id=2467822 external
https://www.cve.org/CVERecord?id=CVE-2026-33811 external
https://nvd.nist.gov/vuln/detail/CVE-2026-33811 external
https://go.dev/cl/767860 external
https://go.dev/issue/78803 external
https://groups.google.com/g/golang-announce/c/qcC… external
https://pkg.go.dev/vuln/GO-2026-4981 external
https://access.redhat.com/security/cve/CVE-2026-33818 self
https://bugzilla.redhat.com/show_bug.cgi?id=2515815 external
https://www.cve.org/CVERecord?id=CVE-2026-33818 external
https://nvd.nist.gov/vuln/detail/CVE-2026-33818 external
https://go.dev/cl/814980 external
https://go.dev/issue/80405 external
https://groups.google.com/g/golang-announce/c/94p… external
https://pkg.go.dev/vuln/GO-2026-5972 external
https://access.redhat.com/security/cve/CVE-2026-42504 self
https://bugzilla.redhat.com/show_bug.cgi?id=2484204 external
https://www.cve.org/CVERecord?id=CVE-2026-42504 external
https://nvd.nist.gov/vuln/detail/CVE-2026-42504 external
https://go.dev/cl/774481 external
https://go.dev/issue/79217 external
https://groups.google.com/g/golang-announce/c/tKs… external
https://pkg.go.dev/vuln/GO-2026-5038 external
https://access.redhat.com/security/cve/CVE-2026-56859 self
https://bugzilla.redhat.com/show_bug.cgi?id=2515840 external
https://www.cve.org/CVERecord?id=CVE-2026-56859 external
https://nvd.nist.gov/vuln/detail/CVE-2026-56859 external
https://go.dev/cl/803320 external
https://go.dev/issue/80481 external
https://pkg.go.dev/vuln/GO-2026-6088 external
https://access.redhat.com/security/cve/CVE-2026-56860 self
https://bugzilla.redhat.com/show_bug.cgi?id=2515820 external
https://www.cve.org/CVERecord?id=CVE-2026-56860 external
https://nvd.nist.gov/vuln/detail/CVE-2026-56860 external
https://go.dev/cl/803681 external
https://go.dev/issue/80494 external
https://pkg.go.dev/vuln/GO-2026-6218 external
https://access.redhat.com/security/cve/CVE-2026-56862 self
https://bugzilla.redhat.com/show_bug.cgi?id=2515839 external
https://www.cve.org/CVERecord?id=CVE-2026-56862 external
https://nvd.nist.gov/vuln/detail/CVE-2026-56862 external
https://go.dev/cl/804261 external
https://go.dev/issue/80528 external
https://pkg.go.dev/vuln/GO-2026-6090 external
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Updated container images that fix multiple bugs are now available for LVMS 4.12",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "After a successful LVMS upgrade, the latest lvms-operator SHA image should be running.\n\nThis erratum implements the following changes:\n\n- Golang version bump to address CVE-2025-68121, CVE-2026-32280, CVE-2026-33811, CVE-2026-42504, CVE-2026-56860, CVE-2026-56859, CVE-2026-56862, CVE-2026-33818\n\nUsers of LVMS are advised to upgrade to the latest version in OpenShift Container Platform, which fixes these bugs and adds these enhancements.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:88199",
        "url": "https://access.redhat.com/errata/RHSA-2026:88199"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-68121",
        "url": "https://access.redhat.com/security/cve/CVE-2025-68121"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-32280",
        "url": "https://access.redhat.com/security/cve/CVE-2026-32280"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-33811",
        "url": "https://access.redhat.com/security/cve/CVE-2026-33811"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-33818",
        "url": "https://access.redhat.com/security/cve/CVE-2026-33818"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-42504",
        "url": "https://access.redhat.com/security/cve/CVE-2026-42504"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-56859",
        "url": "https://access.redhat.com/security/cve/CVE-2026-56859"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-56860",
        "url": "https://access.redhat.com/security/cve/CVE-2026-56860"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-56862",
        "url": "https://access.redhat.com/security/cve/CVE-2026-56862"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_88199.json"
      }
    ],
    "title": "Red Hat Security Advisory: LVMS 4.12 Bug Fix and Enhancement update",
    "tracking": {
      "current_release_date": "2026-11-05T13:15:54+00:00",
      "generator": {
        "date": "2026-11-05T13:15:54+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.4"
        }
      },
      "id": "RHSA-2026:88199",
      "initial_release_date": "2026-10-22T12:16:36+00:00",
      "revision_history": [
        {
          "date": "2026-10-22T12:16:36+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-10-22T12:16:37+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-11-05T13:15:54+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Logical Volume Manager Storage 4.12",
                "product": {
                  "name": "Logical Volume Manager Storage 4.12",
                  "product_id": "Logical Volume Manager Storage 4.12",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:lvms:4.12::el8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Logical Volume Manager Storage"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:0e5b2b2c9e36eb7604976e556aad35245a3254e60e5f258fde028ba8c17ef643_amd64",
                "product": {
                  "name": "registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:0e5b2b2c9e36eb7604976e556aad35245a3254e60e5f258fde028ba8c17ef643_amd64",
                  "product_id": "registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:0e5b2b2c9e36eb7604976e556aad35245a3254e60e5f258fde028ba8c17ef643_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/lvms-rhel8-operator@sha256%3A0e5b2b2c9e36eb7604976e556aad35245a3254e60e5f258fde028ba8c17ef643?arch=amd64\u0026repository_url=registry.redhat.io/lvms4/lvms-rhel8-operator\u0026tag=1792551885"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/lvms4/lvms-operator-bundle@sha256:62efb19ba31393591b35485e779aa0d28b5e038d5007159bf2a5f92f0ec813d5_amd64",
                "product": {
                  "name": "registry.redhat.io/lvms4/lvms-operator-bundle@sha256:62efb19ba31393591b35485e779aa0d28b5e038d5007159bf2a5f92f0ec813d5_amd64",
                  "product_id": "registry.redhat.io/lvms4/lvms-operator-bundle@sha256:62efb19ba31393591b35485e779aa0d28b5e038d5007159bf2a5f92f0ec813d5_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/lvms-operator-bundle@sha256%3A62efb19ba31393591b35485e779aa0d28b5e038d5007159bf2a5f92f0ec813d5?arch=amd64\u0026repository_url=registry.redhat.io/lvms4/lvms-operator-bundle\u0026tag=1792555328"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:b8fca1683e03e5c2f3a981f8f3b7e41fcbd5376d81a24819f9af9a654cbfe0d8_amd64",
                "product": {
                  "name": "registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:b8fca1683e03e5c2f3a981f8f3b7e41fcbd5376d81a24819f9af9a654cbfe0d8_amd64",
                  "product_id": "registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:b8fca1683e03e5c2f3a981f8f3b7e41fcbd5376d81a24819f9af9a654cbfe0d8_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/lvms-must-gather-rhel8@sha256%3Ab8fca1683e03e5c2f3a981f8f3b7e41fcbd5376d81a24819f9af9a654cbfe0d8?arch=amd64\u0026repository_url=registry.redhat.io/lvms4/lvms-must-gather-rhel8\u0026tag=1792503279"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/lvms4/topolvm-rhel8@sha256:57dcfc35580789fffea3095951537def03dc36d6bd99bb7f59c459920cb46a3c_amd64",
                "product": {
                  "name": "registry.redhat.io/lvms4/topolvm-rhel8@sha256:57dcfc35580789fffea3095951537def03dc36d6bd99bb7f59c459920cb46a3c_amd64",
                  "product_id": "registry.redhat.io/lvms4/topolvm-rhel8@sha256:57dcfc35580789fffea3095951537def03dc36d6bd99bb7f59c459920cb46a3c_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/topolvm-rhel8@sha256%3A57dcfc35580789fffea3095951537def03dc36d6bd99bb7f59c459920cb46a3c?arch=amd64\u0026repository_url=registry.redhat.io/lvms4/topolvm-rhel8\u0026tag=1792200715"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:ff47e0294472c280c372ffb6b264bb8dac2a79354b9a55f704a9eca145722e94_arm64",
                "product": {
                  "name": "registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:ff47e0294472c280c372ffb6b264bb8dac2a79354b9a55f704a9eca145722e94_arm64",
                  "product_id": "registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:ff47e0294472c280c372ffb6b264bb8dac2a79354b9a55f704a9eca145722e94_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/lvms-rhel8-operator@sha256%3Aff47e0294472c280c372ffb6b264bb8dac2a79354b9a55f704a9eca145722e94?arch=arm64\u0026repository_url=registry.redhat.io/lvms4/lvms-rhel8-operator\u0026tag=1792551885"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:46bfe8b830548a0f8c2bd5908f569dabd9bf0b2df0f444ac90c9f196b08e7526_arm64",
                "product": {
                  "name": "registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:46bfe8b830548a0f8c2bd5908f569dabd9bf0b2df0f444ac90c9f196b08e7526_arm64",
                  "product_id": "registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:46bfe8b830548a0f8c2bd5908f569dabd9bf0b2df0f444ac90c9f196b08e7526_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/lvms-must-gather-rhel8@sha256%3A46bfe8b830548a0f8c2bd5908f569dabd9bf0b2df0f444ac90c9f196b08e7526?arch=arm64\u0026repository_url=registry.redhat.io/lvms4/lvms-must-gather-rhel8\u0026tag=1792503279"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/lvms4/topolvm-rhel8@sha256:639f7535378635b9116ff6fa387ff07c20caa72d32173fd22b3cbcc8d670b353_arm64",
                "product": {
                  "name": "registry.redhat.io/lvms4/topolvm-rhel8@sha256:639f7535378635b9116ff6fa387ff07c20caa72d32173fd22b3cbcc8d670b353_arm64",
                  "product_id": "registry.redhat.io/lvms4/topolvm-rhel8@sha256:639f7535378635b9116ff6fa387ff07c20caa72d32173fd22b3cbcc8d670b353_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/topolvm-rhel8@sha256%3A639f7535378635b9116ff6fa387ff07c20caa72d32173fd22b3cbcc8d670b353?arch=arm64\u0026repository_url=registry.redhat.io/lvms4/topolvm-rhel8\u0026tag=1792200715"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "arm64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:561e7ea7f530d6a07f70844dd7f88cfe22a3007879b607204fa1402257769e96_ppc64le",
                "product": {
                  "name": "registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:561e7ea7f530d6a07f70844dd7f88cfe22a3007879b607204fa1402257769e96_ppc64le",
                  "product_id": "registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:561e7ea7f530d6a07f70844dd7f88cfe22a3007879b607204fa1402257769e96_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/lvms-rhel8-operator@sha256%3A561e7ea7f530d6a07f70844dd7f88cfe22a3007879b607204fa1402257769e96?arch=ppc64le\u0026repository_url=registry.redhat.io/lvms4/lvms-rhel8-operator\u0026tag=1792551885"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:aeedd116f439373b0ffd779d383a8139e3aa6c2465a81a99d31ed485f93c7136_ppc64le",
                "product": {
                  "name": "registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:aeedd116f439373b0ffd779d383a8139e3aa6c2465a81a99d31ed485f93c7136_ppc64le",
                  "product_id": "registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:aeedd116f439373b0ffd779d383a8139e3aa6c2465a81a99d31ed485f93c7136_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/lvms-must-gather-rhel8@sha256%3Aaeedd116f439373b0ffd779d383a8139e3aa6c2465a81a99d31ed485f93c7136?arch=ppc64le\u0026repository_url=registry.redhat.io/lvms4/lvms-must-gather-rhel8\u0026tag=1792503279"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/lvms4/topolvm-rhel8@sha256:58201e92b1db47183d2f8c41c08dbe256d4180cb64d84a63a0637ea556fc2a99_ppc64le",
                "product": {
                  "name": "registry.redhat.io/lvms4/topolvm-rhel8@sha256:58201e92b1db47183d2f8c41c08dbe256d4180cb64d84a63a0637ea556fc2a99_ppc64le",
                  "product_id": "registry.redhat.io/lvms4/topolvm-rhel8@sha256:58201e92b1db47183d2f8c41c08dbe256d4180cb64d84a63a0637ea556fc2a99_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/topolvm-rhel8@sha256%3A58201e92b1db47183d2f8c41c08dbe256d4180cb64d84a63a0637ea556fc2a99?arch=ppc64le\u0026repository_url=registry.redhat.io/lvms4/topolvm-rhel8\u0026tag=1792200715"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:2089cc8e6c235795da7a00f7e97a9728457b990148bae4f50814b856cf16e52d_s390x",
                "product": {
                  "name": "registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:2089cc8e6c235795da7a00f7e97a9728457b990148bae4f50814b856cf16e52d_s390x",
                  "product_id": "registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:2089cc8e6c235795da7a00f7e97a9728457b990148bae4f50814b856cf16e52d_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/lvms-rhel8-operator@sha256%3A2089cc8e6c235795da7a00f7e97a9728457b990148bae4f50814b856cf16e52d?arch=s390x\u0026repository_url=registry.redhat.io/lvms4/lvms-rhel8-operator\u0026tag=1792551885"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:944c9e33b240ab584ffc67bf0421ab56defa359ca2261b5b4e8ec45b134c859e_s390x",
                "product": {
                  "name": "registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:944c9e33b240ab584ffc67bf0421ab56defa359ca2261b5b4e8ec45b134c859e_s390x",
                  "product_id": "registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:944c9e33b240ab584ffc67bf0421ab56defa359ca2261b5b4e8ec45b134c859e_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/lvms-must-gather-rhel8@sha256%3A944c9e33b240ab584ffc67bf0421ab56defa359ca2261b5b4e8ec45b134c859e?arch=s390x\u0026repository_url=registry.redhat.io/lvms4/lvms-must-gather-rhel8\u0026tag=1792503279"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/lvms4/topolvm-rhel8@sha256:5f0847d9942e1091f48cab27db5f6350e07c0645b9b154141d98aac630d51f0b_s390x",
                "product": {
                  "name": "registry.redhat.io/lvms4/topolvm-rhel8@sha256:5f0847d9942e1091f48cab27db5f6350e07c0645b9b154141d98aac630d51f0b_s390x",
                  "product_id": "registry.redhat.io/lvms4/topolvm-rhel8@sha256:5f0847d9942e1091f48cab27db5f6350e07c0645b9b154141d98aac630d51f0b_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/topolvm-rhel8@sha256%3A5f0847d9942e1091f48cab27db5f6350e07c0645b9b154141d98aac630d51f0b?arch=s390x\u0026repository_url=registry.redhat.io/lvms4/topolvm-rhel8\u0026tag=1792200715"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:46bfe8b830548a0f8c2bd5908f569dabd9bf0b2df0f444ac90c9f196b08e7526_arm64 as a component of Logical Volume Manager Storage 4.12",
          "product_id": "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:46bfe8b830548a0f8c2bd5908f569dabd9bf0b2df0f444ac90c9f196b08e7526_arm64"
        },
        "product_reference": "registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:46bfe8b830548a0f8c2bd5908f569dabd9bf0b2df0f444ac90c9f196b08e7526_arm64",
        "relates_to_product_reference": "Logical Volume Manager Storage 4.12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:944c9e33b240ab584ffc67bf0421ab56defa359ca2261b5b4e8ec45b134c859e_s390x as a component of Logical Volume Manager Storage 4.12",
          "product_id": "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:944c9e33b240ab584ffc67bf0421ab56defa359ca2261b5b4e8ec45b134c859e_s390x"
        },
        "product_reference": "registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:944c9e33b240ab584ffc67bf0421ab56defa359ca2261b5b4e8ec45b134c859e_s390x",
        "relates_to_product_reference": "Logical Volume Manager Storage 4.12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:aeedd116f439373b0ffd779d383a8139e3aa6c2465a81a99d31ed485f93c7136_ppc64le as a component of Logical Volume Manager Storage 4.12",
          "product_id": "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:aeedd116f439373b0ffd779d383a8139e3aa6c2465a81a99d31ed485f93c7136_ppc64le"
        },
        "product_reference": "registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:aeedd116f439373b0ffd779d383a8139e3aa6c2465a81a99d31ed485f93c7136_ppc64le",
        "relates_to_product_reference": "Logical Volume Manager Storage 4.12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:b8fca1683e03e5c2f3a981f8f3b7e41fcbd5376d81a24819f9af9a654cbfe0d8_amd64 as a component of Logical Volume Manager Storage 4.12",
          "product_id": "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:b8fca1683e03e5c2f3a981f8f3b7e41fcbd5376d81a24819f9af9a654cbfe0d8_amd64"
        },
        "product_reference": "registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:b8fca1683e03e5c2f3a981f8f3b7e41fcbd5376d81a24819f9af9a654cbfe0d8_amd64",
        "relates_to_product_reference": "Logical Volume Manager Storage 4.12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/lvms4/lvms-operator-bundle@sha256:62efb19ba31393591b35485e779aa0d28b5e038d5007159bf2a5f92f0ec813d5_amd64 as a component of Logical Volume Manager Storage 4.12",
          "product_id": "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-operator-bundle@sha256:62efb19ba31393591b35485e779aa0d28b5e038d5007159bf2a5f92f0ec813d5_amd64"
        },
        "product_reference": "registry.redhat.io/lvms4/lvms-operator-bundle@sha256:62efb19ba31393591b35485e779aa0d28b5e038d5007159bf2a5f92f0ec813d5_amd64",
        "relates_to_product_reference": "Logical Volume Manager Storage 4.12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:0e5b2b2c9e36eb7604976e556aad35245a3254e60e5f258fde028ba8c17ef643_amd64 as a component of Logical Volume Manager Storage 4.12",
          "product_id": "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:0e5b2b2c9e36eb7604976e556aad35245a3254e60e5f258fde028ba8c17ef643_amd64"
        },
        "product_reference": "registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:0e5b2b2c9e36eb7604976e556aad35245a3254e60e5f258fde028ba8c17ef643_amd64",
        "relates_to_product_reference": "Logical Volume Manager Storage 4.12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:2089cc8e6c235795da7a00f7e97a9728457b990148bae4f50814b856cf16e52d_s390x as a component of Logical Volume Manager Storage 4.12",
          "product_id": "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:2089cc8e6c235795da7a00f7e97a9728457b990148bae4f50814b856cf16e52d_s390x"
        },
        "product_reference": "registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:2089cc8e6c235795da7a00f7e97a9728457b990148bae4f50814b856cf16e52d_s390x",
        "relates_to_product_reference": "Logical Volume Manager Storage 4.12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:561e7ea7f530d6a07f70844dd7f88cfe22a3007879b607204fa1402257769e96_ppc64le as a component of Logical Volume Manager Storage 4.12",
          "product_id": "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:561e7ea7f530d6a07f70844dd7f88cfe22a3007879b607204fa1402257769e96_ppc64le"
        },
        "product_reference": "registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:561e7ea7f530d6a07f70844dd7f88cfe22a3007879b607204fa1402257769e96_ppc64le",
        "relates_to_product_reference": "Logical Volume Manager Storage 4.12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:ff47e0294472c280c372ffb6b264bb8dac2a79354b9a55f704a9eca145722e94_arm64 as a component of Logical Volume Manager Storage 4.12",
          "product_id": "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:ff47e0294472c280c372ffb6b264bb8dac2a79354b9a55f704a9eca145722e94_arm64"
        },
        "product_reference": "registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:ff47e0294472c280c372ffb6b264bb8dac2a79354b9a55f704a9eca145722e94_arm64",
        "relates_to_product_reference": "Logical Volume Manager Storage 4.12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/lvms4/topolvm-rhel8@sha256:57dcfc35580789fffea3095951537def03dc36d6bd99bb7f59c459920cb46a3c_amd64 as a component of Logical Volume Manager Storage 4.12",
          "product_id": "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:57dcfc35580789fffea3095951537def03dc36d6bd99bb7f59c459920cb46a3c_amd64"
        },
        "product_reference": "registry.redhat.io/lvms4/topolvm-rhel8@sha256:57dcfc35580789fffea3095951537def03dc36d6bd99bb7f59c459920cb46a3c_amd64",
        "relates_to_product_reference": "Logical Volume Manager Storage 4.12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/lvms4/topolvm-rhel8@sha256:58201e92b1db47183d2f8c41c08dbe256d4180cb64d84a63a0637ea556fc2a99_ppc64le as a component of Logical Volume Manager Storage 4.12",
          "product_id": "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:58201e92b1db47183d2f8c41c08dbe256d4180cb64d84a63a0637ea556fc2a99_ppc64le"
        },
        "product_reference": "registry.redhat.io/lvms4/topolvm-rhel8@sha256:58201e92b1db47183d2f8c41c08dbe256d4180cb64d84a63a0637ea556fc2a99_ppc64le",
        "relates_to_product_reference": "Logical Volume Manager Storage 4.12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/lvms4/topolvm-rhel8@sha256:5f0847d9942e1091f48cab27db5f6350e07c0645b9b154141d98aac630d51f0b_s390x as a component of Logical Volume Manager Storage 4.12",
          "product_id": "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:5f0847d9942e1091f48cab27db5f6350e07c0645b9b154141d98aac630d51f0b_s390x"
        },
        "product_reference": "registry.redhat.io/lvms4/topolvm-rhel8@sha256:5f0847d9942e1091f48cab27db5f6350e07c0645b9b154141d98aac630d51f0b_s390x",
        "relates_to_product_reference": "Logical Volume Manager Storage 4.12"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/lvms4/topolvm-rhel8@sha256:639f7535378635b9116ff6fa387ff07c20caa72d32173fd22b3cbcc8d670b353_arm64 as a component of Logical Volume Manager Storage 4.12",
          "product_id": "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:639f7535378635b9116ff6fa387ff07c20caa72d32173fd22b3cbcc8d670b353_arm64"
        },
        "product_reference": "registry.redhat.io/lvms4/topolvm-rhel8@sha256:639f7535378635b9116ff6fa387ff07c20caa72d32173fd22b3cbcc8d670b353_arm64",
        "relates_to_product_reference": "Logical Volume Manager Storage 4.12"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-68121",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "discovery_date": "2026-02-05T18:01:30.086058+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:46bfe8b830548a0f8c2bd5908f569dabd9bf0b2df0f444ac90c9f196b08e7526_arm64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:944c9e33b240ab584ffc67bf0421ab56defa359ca2261b5b4e8ec45b134c859e_s390x",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:aeedd116f439373b0ffd779d383a8139e3aa6c2465a81a99d31ed485f93c7136_ppc64le",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:b8fca1683e03e5c2f3a981f8f3b7e41fcbd5376d81a24819f9af9a654cbfe0d8_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-operator-bundle@sha256:62efb19ba31393591b35485e779aa0d28b5e038d5007159bf2a5f92f0ec813d5_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:57dcfc35580789fffea3095951537def03dc36d6bd99bb7f59c459920cb46a3c_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:58201e92b1db47183d2f8c41c08dbe256d4180cb64d84a63a0637ea556fc2a99_ppc64le",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:5f0847d9942e1091f48cab27db5f6350e07c0645b9b154141d98aac630d51f0b_s390x",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:639f7535378635b9116ff6fa387ff07c20caa72d32173fd22b3cbcc8d670b353_arm64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2437111"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the crypto/tls component. This vulnerability occurs during Transport Layer Security (TLS) session resumption when certificate authority (CA) settings are modified between the initial and resumed handshakes. An attacker could exploit this to bypass certificate validation, allowing a client or server to establish a connection that should have been rejected. This could lead to an authentication bypass under specific conditions.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is a moderate flaw because it only occurs under specific conditions, such as TLS session resumption with runtime changes to certificate authority settings. Exploitation is not straightforward and requires a controlled setup. The impact is limited to certificate validation within the same component and does not affect system availability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:0e5b2b2c9e36eb7604976e556aad35245a3254e60e5f258fde028ba8c17ef643_amd64",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:2089cc8e6c235795da7a00f7e97a9728457b990148bae4f50814b856cf16e52d_s390x",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:561e7ea7f530d6a07f70844dd7f88cfe22a3007879b607204fa1402257769e96_ppc64le",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:ff47e0294472c280c372ffb6b264bb8dac2a79354b9a55f704a9eca145722e94_arm64"
        ],
        "known_not_affected": [
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:46bfe8b830548a0f8c2bd5908f569dabd9bf0b2df0f444ac90c9f196b08e7526_arm64",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:944c9e33b240ab584ffc67bf0421ab56defa359ca2261b5b4e8ec45b134c859e_s390x",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:aeedd116f439373b0ffd779d383a8139e3aa6c2465a81a99d31ed485f93c7136_ppc64le",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:b8fca1683e03e5c2f3a981f8f3b7e41fcbd5376d81a24819f9af9a654cbfe0d8_amd64",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-operator-bundle@sha256:62efb19ba31393591b35485e779aa0d28b5e038d5007159bf2a5f92f0ec813d5_amd64",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:57dcfc35580789fffea3095951537def03dc36d6bd99bb7f59c459920cb46a3c_amd64",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:58201e92b1db47183d2f8c41c08dbe256d4180cb64d84a63a0637ea556fc2a99_ppc64le",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:5f0847d9942e1091f48cab27db5f6350e07c0645b9b154141d98aac630d51f0b_s390x",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:639f7535378635b9116ff6fa387ff07c20caa72d32173fd22b3cbcc8d670b353_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-68121"
        },
        {
          "category": "external",
          "summary": "RHBZ#2437111",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2437111"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-68121",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-68121"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-68121",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68121"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/737700",
          "url": "https://go.dev/cl/737700"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/77217",
          "url": "https://go.dev/issue/77217"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/K09ubi9FQFk",
          "url": "https://groups.google.com/g/golang-announce/c/K09ubi9FQFk"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4337",
          "url": "https://pkg.go.dev/vuln/GO-2026-4337"
        }
      ],
      "release_date": "2026-02-05T17:48:44.141000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-22T12:16:36+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:0e5b2b2c9e36eb7604976e556aad35245a3254e60e5f258fde028ba8c17ef643_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:2089cc8e6c235795da7a00f7e97a9728457b990148bae4f50814b856cf16e52d_s390x",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:561e7ea7f530d6a07f70844dd7f88cfe22a3007879b607204fa1402257769e96_ppc64le",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:ff47e0294472c280c372ffb6b264bb8dac2a79354b9a55f704a9eca145722e94_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88199"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:46bfe8b830548a0f8c2bd5908f569dabd9bf0b2df0f444ac90c9f196b08e7526_arm64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:944c9e33b240ab584ffc67bf0421ab56defa359ca2261b5b4e8ec45b134c859e_s390x",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:aeedd116f439373b0ffd779d383a8139e3aa6c2465a81a99d31ed485f93c7136_ppc64le",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:b8fca1683e03e5c2f3a981f8f3b7e41fcbd5376d81a24819f9af9a654cbfe0d8_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-operator-bundle@sha256:62efb19ba31393591b35485e779aa0d28b5e038d5007159bf2a5f92f0ec813d5_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:0e5b2b2c9e36eb7604976e556aad35245a3254e60e5f258fde028ba8c17ef643_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:2089cc8e6c235795da7a00f7e97a9728457b990148bae4f50814b856cf16e52d_s390x",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:561e7ea7f530d6a07f70844dd7f88cfe22a3007879b607204fa1402257769e96_ppc64le",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:ff47e0294472c280c372ffb6b264bb8dac2a79354b9a55f704a9eca145722e94_arm64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:57dcfc35580789fffea3095951537def03dc36d6bd99bb7f59c459920cb46a3c_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:58201e92b1db47183d2f8c41c08dbe256d4180cb64d84a63a0637ea556fc2a99_ppc64le",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:5f0847d9942e1091f48cab27db5f6350e07c0645b9b154141d98aac630d51f0b_s390x",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:639f7535378635b9116ff6fa387ff07c20caa72d32173fd22b3cbcc8d670b353_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:46bfe8b830548a0f8c2bd5908f569dabd9bf0b2df0f444ac90c9f196b08e7526_arm64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:944c9e33b240ab584ffc67bf0421ab56defa359ca2261b5b4e8ec45b134c859e_s390x",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:aeedd116f439373b0ffd779d383a8139e3aa6c2465a81a99d31ed485f93c7136_ppc64le",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:b8fca1683e03e5c2f3a981f8f3b7e41fcbd5376d81a24819f9af9a654cbfe0d8_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-operator-bundle@sha256:62efb19ba31393591b35485e779aa0d28b5e038d5007159bf2a5f92f0ec813d5_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:0e5b2b2c9e36eb7604976e556aad35245a3254e60e5f258fde028ba8c17ef643_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:2089cc8e6c235795da7a00f7e97a9728457b990148bae4f50814b856cf16e52d_s390x",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:561e7ea7f530d6a07f70844dd7f88cfe22a3007879b607204fa1402257769e96_ppc64le",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:ff47e0294472c280c372ffb6b264bb8dac2a79354b9a55f704a9eca145722e94_arm64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:57dcfc35580789fffea3095951537def03dc36d6bd99bb7f59c459920cb46a3c_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:58201e92b1db47183d2f8c41c08dbe256d4180cb64d84a63a0637ea556fc2a99_ppc64le",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:5f0847d9942e1091f48cab27db5f6350e07c0645b9b154141d98aac630d51f0b_s390x",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:639f7535378635b9116ff6fa387ff07c20caa72d32173fd22b3cbcc8d670b353_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption"
    },
    {
      "cve": "CVE-2026-32280",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-04-08T02:01:19.572351+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:46bfe8b830548a0f8c2bd5908f569dabd9bf0b2df0f444ac90c9f196b08e7526_arm64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:944c9e33b240ab584ffc67bf0421ab56defa359ca2261b5b4e8ec45b134c859e_s390x",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:aeedd116f439373b0ffd779d383a8139e3aa6c2465a81a99d31ed485f93c7136_ppc64le",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:b8fca1683e03e5c2f3a981f8f3b7e41fcbd5376d81a24819f9af9a654cbfe0d8_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-operator-bundle@sha256:62efb19ba31393591b35485e779aa0d28b5e038d5007159bf2a5f92f0ec813d5_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:57dcfc35580789fffea3095951537def03dc36d6bd99bb7f59c459920cb46a3c_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:58201e92b1db47183d2f8c41c08dbe256d4180cb64d84a63a0637ea556fc2a99_ppc64le",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:5f0847d9942e1091f48cab27db5f6350e07c0645b9b154141d98aac630d51f0b_s390x",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:639f7535378635b9116ff6fa387ff07c20caa72d32173fd22b3cbcc8d670b353_arm64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2456339"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Go standard library packages `crypto/x509` and `crypto/tls`. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being performed. This can result in a denial of service (DoS) condition, making the affected system or application unavailable to legitimate users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service vulnerability in the Go standard library\u0027s certificate chain building process. Systems utilizing Go applications that process untrusted TLS certificates or X.509 certificate chains are susceptible to resource exhaustion when presented with an excessive number of intermediate certificates, potentially leading to service unavailability. This flaw impacts applications directly using `crypto/x509` or `crypto/tls`.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:0e5b2b2c9e36eb7604976e556aad35245a3254e60e5f258fde028ba8c17ef643_amd64",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:2089cc8e6c235795da7a00f7e97a9728457b990148bae4f50814b856cf16e52d_s390x",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:561e7ea7f530d6a07f70844dd7f88cfe22a3007879b607204fa1402257769e96_ppc64le",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:ff47e0294472c280c372ffb6b264bb8dac2a79354b9a55f704a9eca145722e94_arm64"
        ],
        "known_not_affected": [
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:46bfe8b830548a0f8c2bd5908f569dabd9bf0b2df0f444ac90c9f196b08e7526_arm64",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:944c9e33b240ab584ffc67bf0421ab56defa359ca2261b5b4e8ec45b134c859e_s390x",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:aeedd116f439373b0ffd779d383a8139e3aa6c2465a81a99d31ed485f93c7136_ppc64le",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:b8fca1683e03e5c2f3a981f8f3b7e41fcbd5376d81a24819f9af9a654cbfe0d8_amd64",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-operator-bundle@sha256:62efb19ba31393591b35485e779aa0d28b5e038d5007159bf2a5f92f0ec813d5_amd64",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:57dcfc35580789fffea3095951537def03dc36d6bd99bb7f59c459920cb46a3c_amd64",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:58201e92b1db47183d2f8c41c08dbe256d4180cb64d84a63a0637ea556fc2a99_ppc64le",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:5f0847d9942e1091f48cab27db5f6350e07c0645b9b154141d98aac630d51f0b_s390x",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:639f7535378635b9116ff6fa387ff07c20caa72d32173fd22b3cbcc8d670b353_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-32280"
        },
        {
          "category": "external",
          "summary": "RHBZ#2456339",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456339"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-32280",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-32280"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32280",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32280"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/758320",
          "url": "https://go.dev/cl/758320"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/78282",
          "url": "https://go.dev/issue/78282"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
          "url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4947",
          "url": "https://pkg.go.dev/vuln/GO-2026-4947"
        }
      ],
      "release_date": "2026-04-08T01:06:58.595000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-22T12:16:36+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:0e5b2b2c9e36eb7604976e556aad35245a3254e60e5f258fde028ba8c17ef643_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:2089cc8e6c235795da7a00f7e97a9728457b990148bae4f50814b856cf16e52d_s390x",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:561e7ea7f530d6a07f70844dd7f88cfe22a3007879b607204fa1402257769e96_ppc64le",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:ff47e0294472c280c372ffb6b264bb8dac2a79354b9a55f704a9eca145722e94_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88199"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:46bfe8b830548a0f8c2bd5908f569dabd9bf0b2df0f444ac90c9f196b08e7526_arm64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:944c9e33b240ab584ffc67bf0421ab56defa359ca2261b5b4e8ec45b134c859e_s390x",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:aeedd116f439373b0ffd779d383a8139e3aa6c2465a81a99d31ed485f93c7136_ppc64le",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:b8fca1683e03e5c2f3a981f8f3b7e41fcbd5376d81a24819f9af9a654cbfe0d8_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-operator-bundle@sha256:62efb19ba31393591b35485e779aa0d28b5e038d5007159bf2a5f92f0ec813d5_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:0e5b2b2c9e36eb7604976e556aad35245a3254e60e5f258fde028ba8c17ef643_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:2089cc8e6c235795da7a00f7e97a9728457b990148bae4f50814b856cf16e52d_s390x",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:561e7ea7f530d6a07f70844dd7f88cfe22a3007879b607204fa1402257769e96_ppc64le",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:ff47e0294472c280c372ffb6b264bb8dac2a79354b9a55f704a9eca145722e94_arm64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:57dcfc35580789fffea3095951537def03dc36d6bd99bb7f59c459920cb46a3c_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:58201e92b1db47183d2f8c41c08dbe256d4180cb64d84a63a0637ea556fc2a99_ppc64le",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:5f0847d9942e1091f48cab27db5f6350e07c0645b9b154141d98aac630d51f0b_s390x",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:639f7535378635b9116ff6fa387ff07c20caa72d32173fd22b3cbcc8d670b353_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building"
    },
    {
      "cve": "CVE-2026-33811",
      "cwe": {
        "id": "CWE-1341",
        "name": "Multiple Releases of Same Resource or Handle"
      },
      "discovery_date": "2026-05-07T20:01:34.913869+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:46bfe8b830548a0f8c2bd5908f569dabd9bf0b2df0f444ac90c9f196b08e7526_arm64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:944c9e33b240ab584ffc67bf0421ab56defa359ca2261b5b4e8ec45b134c859e_s390x",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:aeedd116f439373b0ffd779d383a8139e3aa6c2465a81a99d31ed485f93c7136_ppc64le",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:b8fca1683e03e5c2f3a981f8f3b7e41fcbd5376d81a24819f9af9a654cbfe0d8_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-operator-bundle@sha256:62efb19ba31393591b35485e779aa0d28b5e038d5007159bf2a5f92f0ec813d5_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:57dcfc35580789fffea3095951537def03dc36d6bd99bb7f59c459920cb46a3c_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:58201e92b1db47183d2f8c41c08dbe256d4180cb64d84a63a0637ea556fc2a99_ppc64le",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:5f0847d9942e1091f48cab27db5f6350e07c0645b9b154141d98aac630d51f0b_s390x",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:639f7535378635b9116ff6fa387ff07c20caa72d32173fd22b3cbcc8d670b353_arm64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2467822"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `net` package of Go (golang), specifically when using the `LookupCNAME` function with the `cgo` DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name (CNAME) response. This can trigger a double-free of C memory, leading to a crash and a Denial of Service (DoS) for the affected application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service vulnerability in the Go `net` package, affecting applications configured to use the `cgo` DNS resolver. A remote attacker could trigger a double-free memory error by providing a very long CNAME response, leading to a crash of the vulnerable application and impacting service availability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:0e5b2b2c9e36eb7604976e556aad35245a3254e60e5f258fde028ba8c17ef643_amd64",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:2089cc8e6c235795da7a00f7e97a9728457b990148bae4f50814b856cf16e52d_s390x",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:561e7ea7f530d6a07f70844dd7f88cfe22a3007879b607204fa1402257769e96_ppc64le",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:ff47e0294472c280c372ffb6b264bb8dac2a79354b9a55f704a9eca145722e94_arm64"
        ],
        "known_not_affected": [
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:46bfe8b830548a0f8c2bd5908f569dabd9bf0b2df0f444ac90c9f196b08e7526_arm64",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:944c9e33b240ab584ffc67bf0421ab56defa359ca2261b5b4e8ec45b134c859e_s390x",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:aeedd116f439373b0ffd779d383a8139e3aa6c2465a81a99d31ed485f93c7136_ppc64le",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:b8fca1683e03e5c2f3a981f8f3b7e41fcbd5376d81a24819f9af9a654cbfe0d8_amd64",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-operator-bundle@sha256:62efb19ba31393591b35485e779aa0d28b5e038d5007159bf2a5f92f0ec813d5_amd64",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:57dcfc35580789fffea3095951537def03dc36d6bd99bb7f59c459920cb46a3c_amd64",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:58201e92b1db47183d2f8c41c08dbe256d4180cb64d84a63a0637ea556fc2a99_ppc64le",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:5f0847d9942e1091f48cab27db5f6350e07c0645b9b154141d98aac630d51f0b_s390x",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:639f7535378635b9116ff6fa387ff07c20caa72d32173fd22b3cbcc8d670b353_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-33811"
        },
        {
          "category": "external",
          "summary": "RHBZ#2467822",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467822"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-33811",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-33811"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33811",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33811"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/767860",
          "url": "https://go.dev/cl/767860"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/78803",
          "url": "https://go.dev/issue/78803"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M",
          "url": "https://groups.google.com/g/golang-announce/c/qcCIEXso47M"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4981",
          "url": "https://pkg.go.dev/vuln/GO-2026-4981"
        }
      ],
      "release_date": "2026-05-07T19:41:19.285000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-22T12:16:36+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:0e5b2b2c9e36eb7604976e556aad35245a3254e60e5f258fde028ba8c17ef643_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:2089cc8e6c235795da7a00f7e97a9728457b990148bae4f50814b856cf16e52d_s390x",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:561e7ea7f530d6a07f70844dd7f88cfe22a3007879b607204fa1402257769e96_ppc64le",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:ff47e0294472c280c372ffb6b264bb8dac2a79354b9a55f704a9eca145722e94_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88199"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, applications can be configured to use the pure Go DNS resolver instead of the `cgo` DNS resolver. This can be achieved by setting the `GODEBUG` environment variable to `netdns=go`. For example, to run a Go application with this mitigation: `GODEBUG=netdns=go /path/to/your/go/application`. This change may require restarting affected applications or services to take effect. Users should verify that this change does not negatively impact DNS resolution for their specific application environment.",
          "product_ids": [
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:46bfe8b830548a0f8c2bd5908f569dabd9bf0b2df0f444ac90c9f196b08e7526_arm64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:944c9e33b240ab584ffc67bf0421ab56defa359ca2261b5b4e8ec45b134c859e_s390x",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:aeedd116f439373b0ffd779d383a8139e3aa6c2465a81a99d31ed485f93c7136_ppc64le",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:b8fca1683e03e5c2f3a981f8f3b7e41fcbd5376d81a24819f9af9a654cbfe0d8_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-operator-bundle@sha256:62efb19ba31393591b35485e779aa0d28b5e038d5007159bf2a5f92f0ec813d5_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:0e5b2b2c9e36eb7604976e556aad35245a3254e60e5f258fde028ba8c17ef643_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:2089cc8e6c235795da7a00f7e97a9728457b990148bae4f50814b856cf16e52d_s390x",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:561e7ea7f530d6a07f70844dd7f88cfe22a3007879b607204fa1402257769e96_ppc64le",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:ff47e0294472c280c372ffb6b264bb8dac2a79354b9a55f704a9eca145722e94_arm64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:57dcfc35580789fffea3095951537def03dc36d6bd99bb7f59c459920cb46a3c_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:58201e92b1db47183d2f8c41c08dbe256d4180cb64d84a63a0637ea556fc2a99_ppc64le",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:5f0847d9942e1091f48cab27db5f6350e07c0645b9b154141d98aac630d51f0b_s390x",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:639f7535378635b9116ff6fa387ff07c20caa72d32173fd22b3cbcc8d670b353_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:46bfe8b830548a0f8c2bd5908f569dabd9bf0b2df0f444ac90c9f196b08e7526_arm64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:944c9e33b240ab584ffc67bf0421ab56defa359ca2261b5b4e8ec45b134c859e_s390x",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:aeedd116f439373b0ffd779d383a8139e3aa6c2465a81a99d31ed485f93c7136_ppc64le",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:b8fca1683e03e5c2f3a981f8f3b7e41fcbd5376d81a24819f9af9a654cbfe0d8_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-operator-bundle@sha256:62efb19ba31393591b35485e779aa0d28b5e038d5007159bf2a5f92f0ec813d5_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:0e5b2b2c9e36eb7604976e556aad35245a3254e60e5f258fde028ba8c17ef643_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:2089cc8e6c235795da7a00f7e97a9728457b990148bae4f50814b856cf16e52d_s390x",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:561e7ea7f530d6a07f70844dd7f88cfe22a3007879b607204fa1402257769e96_ppc64le",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:ff47e0294472c280c372ffb6b264bb8dac2a79354b9a55f704a9eca145722e94_arm64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:57dcfc35580789fffea3095951537def03dc36d6bd99bb7f59c459920cb46a3c_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:58201e92b1db47183d2f8c41c08dbe256d4180cb64d84a63a0637ea556fc2a99_ppc64le",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:5f0847d9942e1091f48cab27db5f6350e07c0645b9b154141d98aac630d51f0b_s390x",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:639f7535378635b9116ff6fa387ff07c20caa72d32173fd22b3cbcc8d670b353_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME"
    },
    {
      "cve": "CVE-2026-33818",
      "cwe": {
        "id": "CWE-776",
        "name": "Improper Restriction of Recursive Entity References in DTDs"
      },
      "discovery_date": "2026-08-13T22:12:37.151735+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:46bfe8b830548a0f8c2bd5908f569dabd9bf0b2df0f444ac90c9f196b08e7526_arm64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:944c9e33b240ab584ffc67bf0421ab56defa359ca2261b5b4e8ec45b134c859e_s390x",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:aeedd116f439373b0ffd779d383a8139e3aa6c2465a81a99d31ed485f93c7136_ppc64le",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:b8fca1683e03e5c2f3a981f8f3b7e41fcbd5376d81a24819f9af9a654cbfe0d8_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-operator-bundle@sha256:62efb19ba31393591b35485e779aa0d28b5e038d5007159bf2a5f92f0ec813d5_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:57dcfc35580789fffea3095951537def03dc36d6bd99bb7f59c459920cb46a3c_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:58201e92b1db47183d2f8c41c08dbe256d4180cb64d84a63a0637ea556fc2a99_ppc64le",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:5f0847d9942e1091f48cab27db5f6350e07c0645b9b154141d98aac630d51f0b_s390x",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:639f7535378635b9116ff6fa387ff07c20caa72d32173fd22b3cbcc8d670b353_arm64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2515815"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `encoding/asn1` package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One (ASN.1) structure, leading to excessive recursion during the `Unmarshal` operation. This could result in stack exhaustion and a Denial of Service (DoS) condition.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service flaw in the Go encoding/asn1 package, as it can be triggered remotely without authentication. An attacker can provide a malformed ASN.1 structure, causing excessive recursion during unmarshalling and leading to stack exhaustion, which can render the service unavailable.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:0e5b2b2c9e36eb7604976e556aad35245a3254e60e5f258fde028ba8c17ef643_amd64",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:2089cc8e6c235795da7a00f7e97a9728457b990148bae4f50814b856cf16e52d_s390x",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:561e7ea7f530d6a07f70844dd7f88cfe22a3007879b607204fa1402257769e96_ppc64le",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:ff47e0294472c280c372ffb6b264bb8dac2a79354b9a55f704a9eca145722e94_arm64"
        ],
        "known_not_affected": [
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:46bfe8b830548a0f8c2bd5908f569dabd9bf0b2df0f444ac90c9f196b08e7526_arm64",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:944c9e33b240ab584ffc67bf0421ab56defa359ca2261b5b4e8ec45b134c859e_s390x",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:aeedd116f439373b0ffd779d383a8139e3aa6c2465a81a99d31ed485f93c7136_ppc64le",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:b8fca1683e03e5c2f3a981f8f3b7e41fcbd5376d81a24819f9af9a654cbfe0d8_amd64",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-operator-bundle@sha256:62efb19ba31393591b35485e779aa0d28b5e038d5007159bf2a5f92f0ec813d5_amd64",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:57dcfc35580789fffea3095951537def03dc36d6bd99bb7f59c459920cb46a3c_amd64",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:58201e92b1db47183d2f8c41c08dbe256d4180cb64d84a63a0637ea556fc2a99_ppc64le",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:5f0847d9942e1091f48cab27db5f6350e07c0645b9b154141d98aac630d51f0b_s390x",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:639f7535378635b9116ff6fa387ff07c20caa72d32173fd22b3cbcc8d670b353_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-33818"
        },
        {
          "category": "external",
          "summary": "RHBZ#2515815",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515815"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-33818",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-33818"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33818",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33818"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/814980",
          "url": "https://go.dev/cl/814980"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80405",
          "url": "https://go.dev/issue/80405"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI",
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-5972",
          "url": "https://pkg.go.dev/vuln/GO-2026-5972"
        }
      ],
      "release_date": "2026-08-13T21:58:52.821000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-22T12:16:36+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:0e5b2b2c9e36eb7604976e556aad35245a3254e60e5f258fde028ba8c17ef643_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:2089cc8e6c235795da7a00f7e97a9728457b990148bae4f50814b856cf16e52d_s390x",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:561e7ea7f530d6a07f70844dd7f88cfe22a3007879b607204fa1402257769e96_ppc64le",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:ff47e0294472c280c372ffb6b264bb8dac2a79354b9a55f704a9eca145722e94_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88199"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:46bfe8b830548a0f8c2bd5908f569dabd9bf0b2df0f444ac90c9f196b08e7526_arm64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:944c9e33b240ab584ffc67bf0421ab56defa359ca2261b5b4e8ec45b134c859e_s390x",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:aeedd116f439373b0ffd779d383a8139e3aa6c2465a81a99d31ed485f93c7136_ppc64le",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:b8fca1683e03e5c2f3a981f8f3b7e41fcbd5376d81a24819f9af9a654cbfe0d8_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-operator-bundle@sha256:62efb19ba31393591b35485e779aa0d28b5e038d5007159bf2a5f92f0ec813d5_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:0e5b2b2c9e36eb7604976e556aad35245a3254e60e5f258fde028ba8c17ef643_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:2089cc8e6c235795da7a00f7e97a9728457b990148bae4f50814b856cf16e52d_s390x",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:561e7ea7f530d6a07f70844dd7f88cfe22a3007879b607204fa1402257769e96_ppc64le",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:ff47e0294472c280c372ffb6b264bb8dac2a79354b9a55f704a9eca145722e94_arm64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:57dcfc35580789fffea3095951537def03dc36d6bd99bb7f59c459920cb46a3c_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:58201e92b1db47183d2f8c41c08dbe256d4180cb64d84a63a0637ea556fc2a99_ppc64le",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:5f0847d9942e1091f48cab27db5f6350e07c0645b9b154141d98aac630d51f0b_s390x",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:639f7535378635b9116ff6fa387ff07c20caa72d32173fd22b3cbcc8d670b353_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:46bfe8b830548a0f8c2bd5908f569dabd9bf0b2df0f444ac90c9f196b08e7526_arm64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:944c9e33b240ab584ffc67bf0421ab56defa359ca2261b5b4e8ec45b134c859e_s390x",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:aeedd116f439373b0ffd779d383a8139e3aa6c2465a81a99d31ed485f93c7136_ppc64le",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:b8fca1683e03e5c2f3a981f8f3b7e41fcbd5376d81a24819f9af9a654cbfe0d8_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-operator-bundle@sha256:62efb19ba31393591b35485e779aa0d28b5e038d5007159bf2a5f92f0ec813d5_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:0e5b2b2c9e36eb7604976e556aad35245a3254e60e5f258fde028ba8c17ef643_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:2089cc8e6c235795da7a00f7e97a9728457b990148bae4f50814b856cf16e52d_s390x",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:561e7ea7f530d6a07f70844dd7f88cfe22a3007879b607204fa1402257769e96_ppc64le",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:ff47e0294472c280c372ffb6b264bb8dac2a79354b9a55f704a9eca145722e94_arm64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:57dcfc35580789fffea3095951537def03dc36d6bd99bb7f59c459920cb46a3c_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:58201e92b1db47183d2f8c41c08dbe256d4180cb64d84a63a0637ea556fc2a99_ppc64le",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:5f0847d9942e1091f48cab27db5f6350e07c0645b9b154141d98aac630d51f0b_s390x",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:639f7535378635b9116ff6fa387ff07c20caa72d32173fd22b3cbcc8d670b353_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal"
    },
    {
      "cve": "CVE-2026-42504",
      "cwe": {
        "id": "CWE-1050",
        "name": "Excessive Platform Resource Consumption within a Loop"
      },
      "discovery_date": "2026-06-02T23:01:00.320527+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:46bfe8b830548a0f8c2bd5908f569dabd9bf0b2df0f444ac90c9f196b08e7526_arm64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:944c9e33b240ab584ffc67bf0421ab56defa359ca2261b5b4e8ec45b134c859e_s390x",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:aeedd116f439373b0ffd779d383a8139e3aa6c2465a81a99d31ed485f93c7136_ppc64le",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:b8fca1683e03e5c2f3a981f8f3b7e41fcbd5376d81a24819f9af9a654cbfe0d8_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-operator-bundle@sha256:62efb19ba31393591b35485e779aa0d28b5e038d5007159bf2a5f92f0ec813d5_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:57dcfc35580789fffea3095951537def03dc36d6bd99bb7f59c459920cb46a3c_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:58201e92b1db47183d2f8c41c08dbe256d4180cb64d84a63a0637ea556fc2a99_ppc64le",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:5f0847d9942e1091f48cab27db5f6350e07c0645b9b154141d98aac630d51f0b_s390x",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:639f7535378635b9116ff6fa387ff07c20caa72d32173fd22b3cbcc8d670b353_arm64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2484204"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Golang MIME (Multipurpose Internet Mail Extensions) package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service (DoS) for the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is rated as an Important severity flaw. A remote attacker could trigger a Denial of Service by sending a crafted MIME header with numerous invalid encoded-words to an application utilizing the affected Golang MIME package. This could lead to excessive CPU consumption on the system processing the malformed header, impacting service availability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:0e5b2b2c9e36eb7604976e556aad35245a3254e60e5f258fde028ba8c17ef643_amd64",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:2089cc8e6c235795da7a00f7e97a9728457b990148bae4f50814b856cf16e52d_s390x",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:561e7ea7f530d6a07f70844dd7f88cfe22a3007879b607204fa1402257769e96_ppc64le",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:ff47e0294472c280c372ffb6b264bb8dac2a79354b9a55f704a9eca145722e94_arm64"
        ],
        "known_not_affected": [
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:46bfe8b830548a0f8c2bd5908f569dabd9bf0b2df0f444ac90c9f196b08e7526_arm64",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:944c9e33b240ab584ffc67bf0421ab56defa359ca2261b5b4e8ec45b134c859e_s390x",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:aeedd116f439373b0ffd779d383a8139e3aa6c2465a81a99d31ed485f93c7136_ppc64le",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:b8fca1683e03e5c2f3a981f8f3b7e41fcbd5376d81a24819f9af9a654cbfe0d8_amd64",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-operator-bundle@sha256:62efb19ba31393591b35485e779aa0d28b5e038d5007159bf2a5f92f0ec813d5_amd64",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:57dcfc35580789fffea3095951537def03dc36d6bd99bb7f59c459920cb46a3c_amd64",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:58201e92b1db47183d2f8c41c08dbe256d4180cb64d84a63a0637ea556fc2a99_ppc64le",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:5f0847d9942e1091f48cab27db5f6350e07c0645b9b154141d98aac630d51f0b_s390x",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:639f7535378635b9116ff6fa387ff07c20caa72d32173fd22b3cbcc8d670b353_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-42504"
        },
        {
          "category": "external",
          "summary": "RHBZ#2484204",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484204"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-42504",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42504"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42504",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42504"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/774481",
          "url": "https://go.dev/cl/774481"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/79217",
          "url": "https://go.dev/issue/79217"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw",
          "url": "https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-5038",
          "url": "https://pkg.go.dev/vuln/GO-2026-5038"
        }
      ],
      "release_date": "2026-06-02T22:01:37.219000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-22T12:16:36+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:0e5b2b2c9e36eb7604976e556aad35245a3254e60e5f258fde028ba8c17ef643_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:2089cc8e6c235795da7a00f7e97a9728457b990148bae4f50814b856cf16e52d_s390x",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:561e7ea7f530d6a07f70844dd7f88cfe22a3007879b607204fa1402257769e96_ppc64le",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:ff47e0294472c280c372ffb6b264bb8dac2a79354b9a55f704a9eca145722e94_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88199"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, restrict network access to services that process MIME headers from untrusted sources. Implement input validation and sanitization for all incoming data, especially MIME headers, to prevent maliciously crafted content from being processed by applications utilizing the vulnerable Golang MIME package.",
          "product_ids": [
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:46bfe8b830548a0f8c2bd5908f569dabd9bf0b2df0f444ac90c9f196b08e7526_arm64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:944c9e33b240ab584ffc67bf0421ab56defa359ca2261b5b4e8ec45b134c859e_s390x",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:aeedd116f439373b0ffd779d383a8139e3aa6c2465a81a99d31ed485f93c7136_ppc64le",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:b8fca1683e03e5c2f3a981f8f3b7e41fcbd5376d81a24819f9af9a654cbfe0d8_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-operator-bundle@sha256:62efb19ba31393591b35485e779aa0d28b5e038d5007159bf2a5f92f0ec813d5_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:0e5b2b2c9e36eb7604976e556aad35245a3254e60e5f258fde028ba8c17ef643_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:2089cc8e6c235795da7a00f7e97a9728457b990148bae4f50814b856cf16e52d_s390x",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:561e7ea7f530d6a07f70844dd7f88cfe22a3007879b607204fa1402257769e96_ppc64le",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:ff47e0294472c280c372ffb6b264bb8dac2a79354b9a55f704a9eca145722e94_arm64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:57dcfc35580789fffea3095951537def03dc36d6bd99bb7f59c459920cb46a3c_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:58201e92b1db47183d2f8c41c08dbe256d4180cb64d84a63a0637ea556fc2a99_ppc64le",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:5f0847d9942e1091f48cab27db5f6350e07c0645b9b154141d98aac630d51f0b_s390x",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:639f7535378635b9116ff6fa387ff07c20caa72d32173fd22b3cbcc8d670b353_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:46bfe8b830548a0f8c2bd5908f569dabd9bf0b2df0f444ac90c9f196b08e7526_arm64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:944c9e33b240ab584ffc67bf0421ab56defa359ca2261b5b4e8ec45b134c859e_s390x",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:aeedd116f439373b0ffd779d383a8139e3aa6c2465a81a99d31ed485f93c7136_ppc64le",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:b8fca1683e03e5c2f3a981f8f3b7e41fcbd5376d81a24819f9af9a654cbfe0d8_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-operator-bundle@sha256:62efb19ba31393591b35485e779aa0d28b5e038d5007159bf2a5f92f0ec813d5_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:0e5b2b2c9e36eb7604976e556aad35245a3254e60e5f258fde028ba8c17ef643_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:2089cc8e6c235795da7a00f7e97a9728457b990148bae4f50814b856cf16e52d_s390x",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:561e7ea7f530d6a07f70844dd7f88cfe22a3007879b607204fa1402257769e96_ppc64le",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:ff47e0294472c280c372ffb6b264bb8dac2a79354b9a55f704a9eca145722e94_arm64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:57dcfc35580789fffea3095951537def03dc36d6bd99bb7f59c459920cb46a3c_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:58201e92b1db47183d2f8c41c08dbe256d4180cb64d84a63a0637ea556fc2a99_ppc64le",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:5f0847d9942e1091f48cab27db5f6350e07c0645b9b154141d98aac630d51f0b_s390x",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:639f7535378635b9116ff6fa387ff07c20caa72d32173fd22b3cbcc8d670b353_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header"
    },
    {
      "cve": "CVE-2026-56859",
      "cwe": {
        "id": "CWE-776",
        "name": "Improper Restriction of Recursive Entity References in DTDs"
      },
      "discovery_date": "2026-08-13T22:16:52.493058+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:46bfe8b830548a0f8c2bd5908f569dabd9bf0b2df0f444ac90c9f196b08e7526_arm64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:944c9e33b240ab584ffc67bf0421ab56defa359ca2261b5b4e8ec45b134c859e_s390x",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:aeedd116f439373b0ffd779d383a8139e3aa6c2465a81a99d31ed485f93c7136_ppc64le",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:b8fca1683e03e5c2f3a981f8f3b7e41fcbd5376d81a24819f9af9a654cbfe0d8_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-operator-bundle@sha256:62efb19ba31393591b35485e779aa0d28b5e038d5007159bf2a5f92f0ec813d5_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:57dcfc35580789fffea3095951537def03dc36d6bd99bb7f59c459920cb46a3c_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:58201e92b1db47183d2f8c41c08dbe256d4180cb64d84a63a0637ea556fc2a99_ppc64le",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:5f0847d9942e1091f48cab27db5f6350e07c0645b9b154141d98aac630d51f0b_s390x",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:639f7535378635b9116ff6fa387ff07c20caa72d32173fd22b3cbcc8d670b353_arm64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2515840"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `encoding/xml` package of Go. The `DecodeElement` function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service (DoS) for the affected application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "An Important denial of service flaw affects applications utilizing the Go `encoding/xml` package. This vulnerability arises from an issue in XML decoding where a recursion depth counter fails to reset, potentially leading to stack exhaustion when processing malicious XML input.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:0e5b2b2c9e36eb7604976e556aad35245a3254e60e5f258fde028ba8c17ef643_amd64",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:2089cc8e6c235795da7a00f7e97a9728457b990148bae4f50814b856cf16e52d_s390x",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:561e7ea7f530d6a07f70844dd7f88cfe22a3007879b607204fa1402257769e96_ppc64le",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:ff47e0294472c280c372ffb6b264bb8dac2a79354b9a55f704a9eca145722e94_arm64"
        ],
        "known_not_affected": [
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:46bfe8b830548a0f8c2bd5908f569dabd9bf0b2df0f444ac90c9f196b08e7526_arm64",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:944c9e33b240ab584ffc67bf0421ab56defa359ca2261b5b4e8ec45b134c859e_s390x",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:aeedd116f439373b0ffd779d383a8139e3aa6c2465a81a99d31ed485f93c7136_ppc64le",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:b8fca1683e03e5c2f3a981f8f3b7e41fcbd5376d81a24819f9af9a654cbfe0d8_amd64",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-operator-bundle@sha256:62efb19ba31393591b35485e779aa0d28b5e038d5007159bf2a5f92f0ec813d5_amd64",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:57dcfc35580789fffea3095951537def03dc36d6bd99bb7f59c459920cb46a3c_amd64",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:58201e92b1db47183d2f8c41c08dbe256d4180cb64d84a63a0637ea556fc2a99_ppc64le",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:5f0847d9942e1091f48cab27db5f6350e07c0645b9b154141d98aac630d51f0b_s390x",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:639f7535378635b9116ff6fa387ff07c20caa72d32173fd22b3cbcc8d670b353_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56859"
        },
        {
          "category": "external",
          "summary": "RHBZ#2515840",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515840"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56859",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56859"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56859",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56859"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/803320",
          "url": "https://go.dev/cl/803320"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80481",
          "url": "https://go.dev/issue/80481"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI",
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6088",
          "url": "https://pkg.go.dev/vuln/GO-2026-6088"
        }
      ],
      "release_date": "2026-08-13T21:58:52.959000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-22T12:16:36+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:0e5b2b2c9e36eb7604976e556aad35245a3254e60e5f258fde028ba8c17ef643_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:2089cc8e6c235795da7a00f7e97a9728457b990148bae4f50814b856cf16e52d_s390x",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:561e7ea7f530d6a07f70844dd7f88cfe22a3007879b607204fa1402257769e96_ppc64le",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:ff47e0294472c280c372ffb6b264bb8dac2a79354b9a55f704a9eca145722e94_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88199"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:46bfe8b830548a0f8c2bd5908f569dabd9bf0b2df0f444ac90c9f196b08e7526_arm64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:944c9e33b240ab584ffc67bf0421ab56defa359ca2261b5b4e8ec45b134c859e_s390x",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:aeedd116f439373b0ffd779d383a8139e3aa6c2465a81a99d31ed485f93c7136_ppc64le",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:b8fca1683e03e5c2f3a981f8f3b7e41fcbd5376d81a24819f9af9a654cbfe0d8_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-operator-bundle@sha256:62efb19ba31393591b35485e779aa0d28b5e038d5007159bf2a5f92f0ec813d5_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:0e5b2b2c9e36eb7604976e556aad35245a3254e60e5f258fde028ba8c17ef643_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:2089cc8e6c235795da7a00f7e97a9728457b990148bae4f50814b856cf16e52d_s390x",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:561e7ea7f530d6a07f70844dd7f88cfe22a3007879b607204fa1402257769e96_ppc64le",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:ff47e0294472c280c372ffb6b264bb8dac2a79354b9a55f704a9eca145722e94_arm64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:57dcfc35580789fffea3095951537def03dc36d6bd99bb7f59c459920cb46a3c_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:58201e92b1db47183d2f8c41c08dbe256d4180cb64d84a63a0637ea556fc2a99_ppc64le",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:5f0847d9942e1091f48cab27db5f6350e07c0645b9b154141d98aac630d51f0b_s390x",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:639f7535378635b9116ff6fa387ff07c20caa72d32173fd22b3cbcc8d670b353_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:46bfe8b830548a0f8c2bd5908f569dabd9bf0b2df0f444ac90c9f196b08e7526_arm64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:944c9e33b240ab584ffc67bf0421ab56defa359ca2261b5b4e8ec45b134c859e_s390x",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:aeedd116f439373b0ffd779d383a8139e3aa6c2465a81a99d31ed485f93c7136_ppc64le",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:b8fca1683e03e5c2f3a981f8f3b7e41fcbd5376d81a24819f9af9a654cbfe0d8_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-operator-bundle@sha256:62efb19ba31393591b35485e779aa0d28b5e038d5007159bf2a5f92f0ec813d5_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:0e5b2b2c9e36eb7604976e556aad35245a3254e60e5f258fde028ba8c17ef643_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:2089cc8e6c235795da7a00f7e97a9728457b990148bae4f50814b856cf16e52d_s390x",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:561e7ea7f530d6a07f70844dd7f88cfe22a3007879b607204fa1402257769e96_ppc64le",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:ff47e0294472c280c372ffb6b264bb8dac2a79354b9a55f704a9eca145722e94_arm64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:57dcfc35580789fffea3095951537def03dc36d6bd99bb7f59c459920cb46a3c_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:58201e92b1db47183d2f8c41c08dbe256d4180cb64d84a63a0637ea556fc2a99_ppc64le",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:5f0847d9942e1091f48cab27db5f6350e07c0645b9b154141d98aac630d51f0b_s390x",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:639f7535378635b9116ff6fa387ff07c20caa72d32173fd22b3cbcc8d670b353_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue"
    },
    {
      "cve": "CVE-2026-56860",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-08-13T22:13:18.319384+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:46bfe8b830548a0f8c2bd5908f569dabd9bf0b2df0f444ac90c9f196b08e7526_arm64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:944c9e33b240ab584ffc67bf0421ab56defa359ca2261b5b4e8ec45b134c859e_s390x",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:aeedd116f439373b0ffd779d383a8139e3aa6c2465a81a99d31ed485f93c7136_ppc64le",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:b8fca1683e03e5c2f3a981f8f3b7e41fcbd5376d81a24819f9af9a654cbfe0d8_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-operator-bundle@sha256:62efb19ba31393591b35485e779aa0d28b5e038d5007159bf2a5f92f0ec813d5_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:57dcfc35580789fffea3095951537def03dc36d6bd99bb7f59c459920cb46a3c_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:58201e92b1db47183d2f8c41c08dbe256d4180cb64d84a63a0637ea556fc2a99_ppc64le",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:5f0847d9942e1091f48cab27db5f6350e07c0645b9b154141d98aac630d51f0b_s390x",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:639f7535378635b9116ff6fa387ff07c20caa72d32173fd22b3cbcc8d670b353_arm64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2515820"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in `net/url`, a component of `golang`. This vulnerability arises when resolving relative paths that contain numerous parent directory (\u0027..\u0027) segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory allocation. This can result in a Denial of Service (DoS) due to resource exhaustion.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service flaw in the Go `net/url` package. Applications built with Go that process untrusted URLs containing parent directory segments (\u0027..\u0027) may be vulnerable to excessive resource consumption due to quadratic time complexity in path resolution. This can lead to a denial of service, impacting the availability of affected services.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:0e5b2b2c9e36eb7604976e556aad35245a3254e60e5f258fde028ba8c17ef643_amd64",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:2089cc8e6c235795da7a00f7e97a9728457b990148bae4f50814b856cf16e52d_s390x",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:561e7ea7f530d6a07f70844dd7f88cfe22a3007879b607204fa1402257769e96_ppc64le",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:ff47e0294472c280c372ffb6b264bb8dac2a79354b9a55f704a9eca145722e94_arm64"
        ],
        "known_not_affected": [
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:46bfe8b830548a0f8c2bd5908f569dabd9bf0b2df0f444ac90c9f196b08e7526_arm64",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:944c9e33b240ab584ffc67bf0421ab56defa359ca2261b5b4e8ec45b134c859e_s390x",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:aeedd116f439373b0ffd779d383a8139e3aa6c2465a81a99d31ed485f93c7136_ppc64le",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:b8fca1683e03e5c2f3a981f8f3b7e41fcbd5376d81a24819f9af9a654cbfe0d8_amd64",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-operator-bundle@sha256:62efb19ba31393591b35485e779aa0d28b5e038d5007159bf2a5f92f0ec813d5_amd64",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:57dcfc35580789fffea3095951537def03dc36d6bd99bb7f59c459920cb46a3c_amd64",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:58201e92b1db47183d2f8c41c08dbe256d4180cb64d84a63a0637ea556fc2a99_ppc64le",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:5f0847d9942e1091f48cab27db5f6350e07c0645b9b154141d98aac630d51f0b_s390x",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:639f7535378635b9116ff6fa387ff07c20caa72d32173fd22b3cbcc8d670b353_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56860"
        },
        {
          "category": "external",
          "summary": "RHBZ#2515820",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515820"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56860",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56860"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56860",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56860"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/803681",
          "url": "https://go.dev/cl/803681"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80494",
          "url": "https://go.dev/issue/80494"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI",
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6218",
          "url": "https://pkg.go.dev/vuln/GO-2026-6218"
        }
      ],
      "release_date": "2026-08-13T21:58:53.731000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-22T12:16:36+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:0e5b2b2c9e36eb7604976e556aad35245a3254e60e5f258fde028ba8c17ef643_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:2089cc8e6c235795da7a00f7e97a9728457b990148bae4f50814b856cf16e52d_s390x",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:561e7ea7f530d6a07f70844dd7f88cfe22a3007879b607204fa1402257769e96_ppc64le",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:ff47e0294472c280c372ffb6b264bb8dac2a79354b9a55f704a9eca145722e94_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88199"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:46bfe8b830548a0f8c2bd5908f569dabd9bf0b2df0f444ac90c9f196b08e7526_arm64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:944c9e33b240ab584ffc67bf0421ab56defa359ca2261b5b4e8ec45b134c859e_s390x",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:aeedd116f439373b0ffd779d383a8139e3aa6c2465a81a99d31ed485f93c7136_ppc64le",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:b8fca1683e03e5c2f3a981f8f3b7e41fcbd5376d81a24819f9af9a654cbfe0d8_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-operator-bundle@sha256:62efb19ba31393591b35485e779aa0d28b5e038d5007159bf2a5f92f0ec813d5_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:0e5b2b2c9e36eb7604976e556aad35245a3254e60e5f258fde028ba8c17ef643_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:2089cc8e6c235795da7a00f7e97a9728457b990148bae4f50814b856cf16e52d_s390x",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:561e7ea7f530d6a07f70844dd7f88cfe22a3007879b607204fa1402257769e96_ppc64le",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:ff47e0294472c280c372ffb6b264bb8dac2a79354b9a55f704a9eca145722e94_arm64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:57dcfc35580789fffea3095951537def03dc36d6bd99bb7f59c459920cb46a3c_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:58201e92b1db47183d2f8c41c08dbe256d4180cb64d84a63a0637ea556fc2a99_ppc64le",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:5f0847d9942e1091f48cab27db5f6350e07c0645b9b154141d98aac630d51f0b_s390x",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:639f7535378635b9116ff6fa387ff07c20caa72d32173fd22b3cbcc8d670b353_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution"
    },
    {
      "cve": "CVE-2026-56862",
      "cwe": {
        "id": "CWE-1050",
        "name": "Excessive Platform Resource Consumption within a Loop"
      },
      "discovery_date": "2026-08-13T22:16:41.928450+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:46bfe8b830548a0f8c2bd5908f569dabd9bf0b2df0f444ac90c9f196b08e7526_arm64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:944c9e33b240ab584ffc67bf0421ab56defa359ca2261b5b4e8ec45b134c859e_s390x",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:aeedd116f439373b0ffd779d383a8139e3aa6c2465a81a99d31ed485f93c7136_ppc64le",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:b8fca1683e03e5c2f3a981f8f3b7e41fcbd5376d81a24819f9af9a654cbfe0d8_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-operator-bundle@sha256:62efb19ba31393591b35485e779aa0d28b5e038d5007159bf2a5f92f0ec813d5_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:57dcfc35580789fffea3095951537def03dc36d6bd99bb7f59c459920cb46a3c_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:58201e92b1db47183d2f8c41c08dbe256d4180cb64d84a63a0637ea556fc2a99_ppc64le",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:5f0847d9942e1091f48cab27db5f6350e07c0645b9b154141d98aac630d51f0b_s390x",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:639f7535378635b9116ff6fa387ff07c20caa72d32173fd22b3cbcc8d670b353_arm64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2515839"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `crypto/tls` package, part of `golang`. A malicious client can exploit this vulnerability by continuously sending KeyUpdate messages to a server. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service (DoS) condition.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service vulnerability in the `golang` `crypto/tls` package. A remote, unauthenticated attacker can exploit this flaw by continuously sending `KeyUpdate` messages during a TLS handshake, forcing the server to perform indefinite key derivation operations. This resource exhaustion can lead to a denial of service for applications and services in Red Hat products that use the affected `crypto/tls` library and are exposed to untrusted network clients.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:0e5b2b2c9e36eb7604976e556aad35245a3254e60e5f258fde028ba8c17ef643_amd64",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:2089cc8e6c235795da7a00f7e97a9728457b990148bae4f50814b856cf16e52d_s390x",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:561e7ea7f530d6a07f70844dd7f88cfe22a3007879b607204fa1402257769e96_ppc64le",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:ff47e0294472c280c372ffb6b264bb8dac2a79354b9a55f704a9eca145722e94_arm64"
        ],
        "known_not_affected": [
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:46bfe8b830548a0f8c2bd5908f569dabd9bf0b2df0f444ac90c9f196b08e7526_arm64",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:944c9e33b240ab584ffc67bf0421ab56defa359ca2261b5b4e8ec45b134c859e_s390x",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:aeedd116f439373b0ffd779d383a8139e3aa6c2465a81a99d31ed485f93c7136_ppc64le",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:b8fca1683e03e5c2f3a981f8f3b7e41fcbd5376d81a24819f9af9a654cbfe0d8_amd64",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-operator-bundle@sha256:62efb19ba31393591b35485e779aa0d28b5e038d5007159bf2a5f92f0ec813d5_amd64",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:57dcfc35580789fffea3095951537def03dc36d6bd99bb7f59c459920cb46a3c_amd64",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:58201e92b1db47183d2f8c41c08dbe256d4180cb64d84a63a0637ea556fc2a99_ppc64le",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:5f0847d9942e1091f48cab27db5f6350e07c0645b9b154141d98aac630d51f0b_s390x",
          "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:639f7535378635b9116ff6fa387ff07c20caa72d32173fd22b3cbcc8d670b353_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56862"
        },
        {
          "category": "external",
          "summary": "RHBZ#2515839",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515839"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56862",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56862"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56862",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56862"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/804261",
          "url": "https://go.dev/cl/804261"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80528",
          "url": "https://go.dev/issue/80528"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI",
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6090",
          "url": "https://pkg.go.dev/vuln/GO-2026-6090"
        }
      ],
      "release_date": "2026-08-13T21:58:53.216000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-22T12:16:36+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:0e5b2b2c9e36eb7604976e556aad35245a3254e60e5f258fde028ba8c17ef643_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:2089cc8e6c235795da7a00f7e97a9728457b990148bae4f50814b856cf16e52d_s390x",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:561e7ea7f530d6a07f70844dd7f88cfe22a3007879b607204fa1402257769e96_ppc64le",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:ff47e0294472c280c372ffb6b264bb8dac2a79354b9a55f704a9eca145722e94_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:88199"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:46bfe8b830548a0f8c2bd5908f569dabd9bf0b2df0f444ac90c9f196b08e7526_arm64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:944c9e33b240ab584ffc67bf0421ab56defa359ca2261b5b4e8ec45b134c859e_s390x",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:aeedd116f439373b0ffd779d383a8139e3aa6c2465a81a99d31ed485f93c7136_ppc64le",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-must-gather-rhel8@sha256:b8fca1683e03e5c2f3a981f8f3b7e41fcbd5376d81a24819f9af9a654cbfe0d8_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-operator-bundle@sha256:62efb19ba31393591b35485e779aa0d28b5e038d5007159bf2a5f92f0ec813d5_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:0e5b2b2c9e36eb7604976e556aad35245a3254e60e5f258fde028ba8c17ef643_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:2089cc8e6c235795da7a00f7e97a9728457b990148bae4f50814b856cf16e52d_s390x",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:561e7ea7f530d6a07f70844dd7f88cfe22a3007879b607204fa1402257769e96_ppc64le",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/lvms-rhel8-operator@sha256:ff47e0294472c280c372ffb6b264bb8dac2a79354b9a55f704a9eca145722e94_arm64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:57dcfc35580789fffea3095951537def03dc36d6bd99bb7f59c459920cb46a3c_amd64",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:58201e92b1db47183d2f8c41c08dbe256d4180cb64d84a63a0637ea556fc2a99_ppc64le",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:5f0847d9942e1091f48cab27db5f6350e07c0645b9b154141d98aac630d51f0b_s390x",
            "Logical Volume Manager Storage 4.12:registry.redhat.io/lvms4/topolvm-rhel8@sha256:639f7535378635b9116ff6fa387ff07c20caa72d32173fd22b3cbcc8d670b353_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON
How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.