RHSA-2026:90363

Vulnerability from csaf_redhat - Published: 2026-10-26 18:45 - Updated: 2026-11-03 05:11
Summary
Red Hat Security Advisory: osbuild-composer security update
Severity
Important
Notes
Topic: An update for osbuild-composer is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients. Security Fix(es): * google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186) * golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136) * golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681) * golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering (CVE-2026-42502) * github.com/labstack/echo: Echo: Unauthorized Information Disclosure via URL Path Decoding Discrepancy (CVE-2026-55677) * crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

A flaw was found in golang.org/x/net/html. A remote attacker could exploit this vulnerability by providing specially crafted HTML. When this arbitrary HTML is parsed and rendered, it can result in an unexpected HTML tree, bypassing input sanitization. This can be leveraged to execute Cross-Site Scripting (XSS) attacks, potentially leading to arbitrary code execution in applications that use the affected component.

CWE-79 - Improper Neutralization of Input During Web Page Generation
Affected products
Product Identifier Version Remediation
Unresolved product id: AppStream-8.8.0.Z.E4S:osbuild-composer-0:75-12.el8_8.ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:osbuild-composer-0:75-12.el8_8.src —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:osbuild-composer-0:75-12.el8_8.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:osbuild-composer-core-0:75-12.el8_8.ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:osbuild-composer-core-0:75-12.el8_8.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:osbuild-composer-core-debuginfo-0:75-12.el8_8.ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:osbuild-composer-core-debuginfo-0:75-12.el8_8.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:osbuild-composer-debuginfo-0:75-12.el8_8.ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:osbuild-composer-debuginfo-0:75-12.el8_8.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:osbuild-composer-debugsource-0:75-12.el8_8.ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:osbuild-composer-debugsource-0:75-12.el8_8.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:osbuild-composer-dnf-json-0:75-12.el8_8.ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:osbuild-composer-dnf-json-0:75-12.el8_8.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:osbuild-composer-tests-debuginfo-0:75-12.el8_8.ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:osbuild-composer-tests-debuginfo-0:75-12.el8_8.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:osbuild-composer-worker-0:75-12.el8_8.ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:osbuild-composer-worker-0:75-12.el8_8.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:osbuild-composer-worker-debuginfo-0:75-12.el8_8.ppc64le —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-8.8.0.Z.E4S:osbuild-composer-worker-debuginfo-0:75-12.el8_8.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:osbuild-composer-0:75-12.el8_8.src —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:osbuild-composer-0:75-12.el8_8.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:osbuild-composer-core-0:75-12.el8_8.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:osbuild-composer-core-debuginfo-0:75-12.el8_8.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:osbuild-composer-debuginfo-0:75-12.el8_8.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:osbuild-composer-debugsource-0:75-12.el8_8.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:osbuild-composer-dnf-json-0:75-12.el8_8.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:osbuild-composer-tests-debuginfo-0:75-12.el8_8.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:osbuild-composer-worker-0:75-12.el8_8.x86_64 —
Vendor Fix fix
Workaround
Unresolved product id: AppStream-8.8.0.Z.TUS:osbuild-composer-worker-debuginfo-0:75-12.el8_8.x86_64 —
Vendor Fix fix
Workaround
Threats
Impact Important

A flaw was found in golang.org/x/net/html. When arbitrary HTML is parsed and then rendered, it can result in an unexpected HTML tree. This allows an attacker to bypass HTML sanitization mechanisms, leading to Cross-Site Scripting (XSS) attacks in applications. Such attacks can result in information disclosure or arbitrary code execution.

CWE-79 - Improper Neutralization of Input During Web Page Generation
Affected products
Fixed 29 products, the same list as for CVE-2026-25681
Threats
Impact Important

A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.

CWE-551 - Incorrect Behavior Order: Authorization Before Parsing and Canonicalization
Affected products
Fixed 29 products, the same list as for CVE-2026-25681
Threats
Impact Important

A flaw was found in golang.org/x/net/html. This vulnerability allows an attacker to manipulate how HTML is processed and displayed. By providing specially crafted HTML, an attacker can cause an unexpected structure in the rendered output. This can lead to Cross-Site Scripting (XSS) attacks, where malicious scripts are executed in a user's web browser, potentially compromising user data or taking control of their session.

CWE-79 - Improper Neutralization of Input During Web Page Generation
Affected products
Fixed 29 products, the same list as for CVE-2026-25681
Threats
Impact Moderate

A flaw was found in Echo, a Go web framework. An attacker can exploit a disagreement in URL path decoding between the router and the static file handler. The router processes raw encoded paths, while the static file handler unescapes encoded forward slashes. This allows an attacker to bypass route-level access controls, leading to unauthorized information disclosure by reading static files.

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory
Affected products
Fixed 29 products, the same list as for CVE-2026-25681
Threats
Impact Important

A flaw was found in Go's crypto/x509 package. The certificate verification process fails to block trust in intermediate certificates associated with a compromised Certificate Authority (CA). A remote attacker presenting a certificate signed by these intermediate authorities can impersonate legitimate servers during secure connections. This flaw can enable an attacker to conduct a man-in-the-middle (MitM) attack to intercept or alter confidential communications.

CWE-295 - Improper Certificate Validation
Affected products
Fixed 29 products, the same list as for CVE-2026-25681
Threats
Impact Important
References
URL Category
https://access.redhat.com/errata/RHSA-2026:90363 self
https://access.redhat.com/security/updates/classi… external
https://bugzilla.redhat.com/show_bug.cgi?id=2449833 external
https://bugzilla.redhat.com/show_bug.cgi?id=2480757 external
https://bugzilla.redhat.com/show_bug.cgi?id=2480761 external
https://bugzilla.redhat.com/show_bug.cgi?id=2480762 external
https://bugzilla.redhat.com/show_bug.cgi?id=2493622 external
https://bugzilla.redhat.com/show_bug.cgi?id=2556068 external
https://security.access.redhat.com/data/csaf/v2/a… self
https://access.redhat.com/security/cve/CVE-2026-25681 self
https://bugzilla.redhat.com/show_bug.cgi?id=2480761 external
https://www.cve.org/CVERecord?id=CVE-2026-25681 external
https://nvd.nist.gov/vuln/detail/CVE-2026-25681 external
https://go.dev/cl/781703 external
https://go.dev/issue/79574 external
https://groups.google.com/g/golang-announce/c/iI-… external
https://pkg.go.dev/vuln/GO-2026-5029 external
https://access.redhat.com/security/cve/CVE-2026-27136 self
https://bugzilla.redhat.com/show_bug.cgi?id=2480757 external
https://www.cve.org/CVERecord?id=CVE-2026-27136 external
https://nvd.nist.gov/vuln/detail/CVE-2026-27136 external
https://go.dev/cl/781685 external
https://go.dev/issue/79575 external
https://pkg.go.dev/vuln/GO-2026-5030 external
https://access.redhat.com/security/cve/CVE-2026-33186 self
https://bugzilla.redhat.com/show_bug.cgi?id=2449833 external
https://www.cve.org/CVERecord?id=CVE-2026-33186 external
https://nvd.nist.gov/vuln/detail/CVE-2026-33186 external
https://github.com/grpc/grpc-go/security/advisori… external
https://access.redhat.com/security/cve/CVE-2026-42502 self
https://bugzilla.redhat.com/show_bug.cgi?id=2480762 external
https://www.cve.org/CVERecord?id=CVE-2026-42502 external
https://nvd.nist.gov/vuln/detail/CVE-2026-42502 external
https://go.dev/cl/781701 external
https://go.dev/issue/79572 external
https://pkg.go.dev/vuln/GO-2026-5027 external
https://access.redhat.com/security/cve/CVE-2026-55677 self
https://bugzilla.redhat.com/show_bug.cgi?id=2493622 external
https://www.cve.org/CVERecord?id=CVE-2026-55677 external
https://nvd.nist.gov/vuln/detail/CVE-2026-55677 external
https://github.com/labstack/echo/security/advisor… external
https://access.redhat.com/security/cve/CVE-2026-111943 self
https://bugzilla.redhat.com/show_bug.cgi?id=2556068 external
https://access.redhat.com/security/vulnerabilitie… external
https://www.cve.org/CVERecord?id=CVE-2026-111943 external
https://nvd.nist.gov/vuln/detail/CVE-2026-111943 external
https://github.com/golang/go/issues/82345 external
https://groups.google.com/g/golang-nuts/c/K22sG2AYnKU external
https://pkg.go.dev/vuln/GO-2026-6809 external

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for osbuild-composer is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud.  It is compatible with composer-cli and cockpit-composer clients.\n\nSecurity Fix(es):\n\n* google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186)\n\n* golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136)\n\n* golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681)\n\n* golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering (CVE-2026-42502)\n\n* github.com/labstack/echo: Echo: Unauthorized Information Disclosure via URL Path Decoding Discrepancy (CVE-2026-55677)\n\n* crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:90363",
        "url": "https://access.redhat.com/errata/RHSA-2026:90363"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2449833",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449833"
      },
      {
        "category": "external",
        "summary": "2480757",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480757"
      },
      {
        "category": "external",
        "summary": "2480761",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480761"
      },
      {
        "category": "external",
        "summary": "2480762",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480762"
      },
      {
        "category": "external",
        "summary": "2493622",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493622"
      },
      {
        "category": "external",
        "summary": "2556068",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556068"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_90363.json"
      }
    ],
    "title": "Red Hat Security Advisory: osbuild-composer security update",
    "tracking": {
      "current_release_date": "2026-11-03T05:11:06+00:00",
      "generator": {
        "date": "2026-11-03T05:11:06+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.4"
        }
      },
      "id": "RHSA-2026:90363",
      "initial_release_date": "2026-10-26T18:45:32+00:00",
      "revision_history": [
        {
          "date": "2026-10-26T18:45:32+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-10-26T18:45:32+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-11-03T05:11:06+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream E4S (v.8.8)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream E4S (v.8.8)",
                  "product_id": "AppStream-8.8.0.Z.E4S",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_e4s:8.8::appstream"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux AppStream TUS (v.8.8)",
                "product": {
                  "name": "Red Hat Enterprise Linux AppStream TUS (v.8.8)",
                  "product_id": "AppStream-8.8.0.Z.TUS",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_tus:8.8::appstream"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "osbuild-composer-0:75-12.el8_8.x86_64",
                "product": {
                  "name": "osbuild-composer-0:75-12.el8_8.x86_64",
                  "product_id": "osbuild-composer-0:75-12.el8_8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer@75-12.el8_8?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "osbuild-composer-core-0:75-12.el8_8.x86_64",
                "product": {
                  "name": "osbuild-composer-core-0:75-12.el8_8.x86_64",
                  "product_id": "osbuild-composer-core-0:75-12.el8_8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer-core@75-12.el8_8?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "osbuild-composer-dnf-json-0:75-12.el8_8.x86_64",
                "product": {
                  "name": "osbuild-composer-dnf-json-0:75-12.el8_8.x86_64",
                  "product_id": "osbuild-composer-dnf-json-0:75-12.el8_8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer-dnf-json@75-12.el8_8?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "osbuild-composer-worker-0:75-12.el8_8.x86_64",
                "product": {
                  "name": "osbuild-composer-worker-0:75-12.el8_8.x86_64",
                  "product_id": "osbuild-composer-worker-0:75-12.el8_8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer-worker@75-12.el8_8?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "osbuild-composer-debugsource-0:75-12.el8_8.x86_64",
                "product": {
                  "name": "osbuild-composer-debugsource-0:75-12.el8_8.x86_64",
                  "product_id": "osbuild-composer-debugsource-0:75-12.el8_8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer-debugsource@75-12.el8_8?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "osbuild-composer-core-debuginfo-0:75-12.el8_8.x86_64",
                "product": {
                  "name": "osbuild-composer-core-debuginfo-0:75-12.el8_8.x86_64",
                  "product_id": "osbuild-composer-core-debuginfo-0:75-12.el8_8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer-core-debuginfo@75-12.el8_8?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "osbuild-composer-debuginfo-0:75-12.el8_8.x86_64",
                "product": {
                  "name": "osbuild-composer-debuginfo-0:75-12.el8_8.x86_64",
                  "product_id": "osbuild-composer-debuginfo-0:75-12.el8_8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer-debuginfo@75-12.el8_8?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "osbuild-composer-tests-debuginfo-0:75-12.el8_8.x86_64",
                "product": {
                  "name": "osbuild-composer-tests-debuginfo-0:75-12.el8_8.x86_64",
                  "product_id": "osbuild-composer-tests-debuginfo-0:75-12.el8_8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer-tests-debuginfo@75-12.el8_8?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "osbuild-composer-worker-debuginfo-0:75-12.el8_8.x86_64",
                "product": {
                  "name": "osbuild-composer-worker-debuginfo-0:75-12.el8_8.x86_64",
                  "product_id": "osbuild-composer-worker-debuginfo-0:75-12.el8_8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer-worker-debuginfo@75-12.el8_8?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "osbuild-composer-0:75-12.el8_8.src",
                "product": {
                  "name": "osbuild-composer-0:75-12.el8_8.src",
                  "product_id": "osbuild-composer-0:75-12.el8_8.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer@75-12.el8_8?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "osbuild-composer-0:75-12.el8_8.ppc64le",
                "product": {
                  "name": "osbuild-composer-0:75-12.el8_8.ppc64le",
                  "product_id": "osbuild-composer-0:75-12.el8_8.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer@75-12.el8_8?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "osbuild-composer-core-0:75-12.el8_8.ppc64le",
                "product": {
                  "name": "osbuild-composer-core-0:75-12.el8_8.ppc64le",
                  "product_id": "osbuild-composer-core-0:75-12.el8_8.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer-core@75-12.el8_8?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "osbuild-composer-dnf-json-0:75-12.el8_8.ppc64le",
                "product": {
                  "name": "osbuild-composer-dnf-json-0:75-12.el8_8.ppc64le",
                  "product_id": "osbuild-composer-dnf-json-0:75-12.el8_8.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer-dnf-json@75-12.el8_8?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "osbuild-composer-worker-0:75-12.el8_8.ppc64le",
                "product": {
                  "name": "osbuild-composer-worker-0:75-12.el8_8.ppc64le",
                  "product_id": "osbuild-composer-worker-0:75-12.el8_8.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer-worker@75-12.el8_8?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "osbuild-composer-debugsource-0:75-12.el8_8.ppc64le",
                "product": {
                  "name": "osbuild-composer-debugsource-0:75-12.el8_8.ppc64le",
                  "product_id": "osbuild-composer-debugsource-0:75-12.el8_8.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer-debugsource@75-12.el8_8?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "osbuild-composer-core-debuginfo-0:75-12.el8_8.ppc64le",
                "product": {
                  "name": "osbuild-composer-core-debuginfo-0:75-12.el8_8.ppc64le",
                  "product_id": "osbuild-composer-core-debuginfo-0:75-12.el8_8.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer-core-debuginfo@75-12.el8_8?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "osbuild-composer-debuginfo-0:75-12.el8_8.ppc64le",
                "product": {
                  "name": "osbuild-composer-debuginfo-0:75-12.el8_8.ppc64le",
                  "product_id": "osbuild-composer-debuginfo-0:75-12.el8_8.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer-debuginfo@75-12.el8_8?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "osbuild-composer-tests-debuginfo-0:75-12.el8_8.ppc64le",
                "product": {
                  "name": "osbuild-composer-tests-debuginfo-0:75-12.el8_8.ppc64le",
                  "product_id": "osbuild-composer-tests-debuginfo-0:75-12.el8_8.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer-tests-debuginfo@75-12.el8_8?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "osbuild-composer-worker-debuginfo-0:75-12.el8_8.ppc64le",
                "product": {
                  "name": "osbuild-composer-worker-debuginfo-0:75-12.el8_8.ppc64le",
                  "product_id": "osbuild-composer-worker-debuginfo-0:75-12.el8_8.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/osbuild-composer-worker-debuginfo@75-12.el8_8?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-0:75-12.el8_8.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.E4S:osbuild-composer-0:75-12.el8_8.ppc64le"
        },
        "product_reference": "osbuild-composer-0:75-12.el8_8.ppc64le",
        "relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-0:75-12.el8_8.src as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.E4S:osbuild-composer-0:75-12.el8_8.src"
        },
        "product_reference": "osbuild-composer-0:75-12.el8_8.src",
        "relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-0:75-12.el8_8.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.E4S:osbuild-composer-0:75-12.el8_8.x86_64"
        },
        "product_reference": "osbuild-composer-0:75-12.el8_8.x86_64",
        "relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-core-0:75-12.el8_8.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.E4S:osbuild-composer-core-0:75-12.el8_8.ppc64le"
        },
        "product_reference": "osbuild-composer-core-0:75-12.el8_8.ppc64le",
        "relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-core-0:75-12.el8_8.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.E4S:osbuild-composer-core-0:75-12.el8_8.x86_64"
        },
        "product_reference": "osbuild-composer-core-0:75-12.el8_8.x86_64",
        "relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-core-debuginfo-0:75-12.el8_8.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.E4S:osbuild-composer-core-debuginfo-0:75-12.el8_8.ppc64le"
        },
        "product_reference": "osbuild-composer-core-debuginfo-0:75-12.el8_8.ppc64le",
        "relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-core-debuginfo-0:75-12.el8_8.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.E4S:osbuild-composer-core-debuginfo-0:75-12.el8_8.x86_64"
        },
        "product_reference": "osbuild-composer-core-debuginfo-0:75-12.el8_8.x86_64",
        "relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-debuginfo-0:75-12.el8_8.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.E4S:osbuild-composer-debuginfo-0:75-12.el8_8.ppc64le"
        },
        "product_reference": "osbuild-composer-debuginfo-0:75-12.el8_8.ppc64le",
        "relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-debuginfo-0:75-12.el8_8.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.E4S:osbuild-composer-debuginfo-0:75-12.el8_8.x86_64"
        },
        "product_reference": "osbuild-composer-debuginfo-0:75-12.el8_8.x86_64",
        "relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-debugsource-0:75-12.el8_8.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.E4S:osbuild-composer-debugsource-0:75-12.el8_8.ppc64le"
        },
        "product_reference": "osbuild-composer-debugsource-0:75-12.el8_8.ppc64le",
        "relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-debugsource-0:75-12.el8_8.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.E4S:osbuild-composer-debugsource-0:75-12.el8_8.x86_64"
        },
        "product_reference": "osbuild-composer-debugsource-0:75-12.el8_8.x86_64",
        "relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-dnf-json-0:75-12.el8_8.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.E4S:osbuild-composer-dnf-json-0:75-12.el8_8.ppc64le"
        },
        "product_reference": "osbuild-composer-dnf-json-0:75-12.el8_8.ppc64le",
        "relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-dnf-json-0:75-12.el8_8.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.E4S:osbuild-composer-dnf-json-0:75-12.el8_8.x86_64"
        },
        "product_reference": "osbuild-composer-dnf-json-0:75-12.el8_8.x86_64",
        "relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-tests-debuginfo-0:75-12.el8_8.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.E4S:osbuild-composer-tests-debuginfo-0:75-12.el8_8.ppc64le"
        },
        "product_reference": "osbuild-composer-tests-debuginfo-0:75-12.el8_8.ppc64le",
        "relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-tests-debuginfo-0:75-12.el8_8.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.E4S:osbuild-composer-tests-debuginfo-0:75-12.el8_8.x86_64"
        },
        "product_reference": "osbuild-composer-tests-debuginfo-0:75-12.el8_8.x86_64",
        "relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-worker-0:75-12.el8_8.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-0:75-12.el8_8.ppc64le"
        },
        "product_reference": "osbuild-composer-worker-0:75-12.el8_8.ppc64le",
        "relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-worker-0:75-12.el8_8.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-0:75-12.el8_8.x86_64"
        },
        "product_reference": "osbuild-composer-worker-0:75-12.el8_8.x86_64",
        "relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-worker-debuginfo-0:75-12.el8_8.ppc64le as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-debuginfo-0:75-12.el8_8.ppc64le"
        },
        "product_reference": "osbuild-composer-worker-debuginfo-0:75-12.el8_8.ppc64le",
        "relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-worker-debuginfo-0:75-12.el8_8.x86_64 as a component of Red Hat Enterprise Linux AppStream E4S (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-debuginfo-0:75-12.el8_8.x86_64"
        },
        "product_reference": "osbuild-composer-worker-debuginfo-0:75-12.el8_8.x86_64",
        "relates_to_product_reference": "AppStream-8.8.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-0:75-12.el8_8.src as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.TUS:osbuild-composer-0:75-12.el8_8.src"
        },
        "product_reference": "osbuild-composer-0:75-12.el8_8.src",
        "relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-0:75-12.el8_8.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.TUS:osbuild-composer-0:75-12.el8_8.x86_64"
        },
        "product_reference": "osbuild-composer-0:75-12.el8_8.x86_64",
        "relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-core-0:75-12.el8_8.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.TUS:osbuild-composer-core-0:75-12.el8_8.x86_64"
        },
        "product_reference": "osbuild-composer-core-0:75-12.el8_8.x86_64",
        "relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-core-debuginfo-0:75-12.el8_8.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.TUS:osbuild-composer-core-debuginfo-0:75-12.el8_8.x86_64"
        },
        "product_reference": "osbuild-composer-core-debuginfo-0:75-12.el8_8.x86_64",
        "relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-debuginfo-0:75-12.el8_8.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.TUS:osbuild-composer-debuginfo-0:75-12.el8_8.x86_64"
        },
        "product_reference": "osbuild-composer-debuginfo-0:75-12.el8_8.x86_64",
        "relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-debugsource-0:75-12.el8_8.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.TUS:osbuild-composer-debugsource-0:75-12.el8_8.x86_64"
        },
        "product_reference": "osbuild-composer-debugsource-0:75-12.el8_8.x86_64",
        "relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-dnf-json-0:75-12.el8_8.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.TUS:osbuild-composer-dnf-json-0:75-12.el8_8.x86_64"
        },
        "product_reference": "osbuild-composer-dnf-json-0:75-12.el8_8.x86_64",
        "relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-tests-debuginfo-0:75-12.el8_8.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.TUS:osbuild-composer-tests-debuginfo-0:75-12.el8_8.x86_64"
        },
        "product_reference": "osbuild-composer-tests-debuginfo-0:75-12.el8_8.x86_64",
        "relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-worker-0:75-12.el8_8.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.TUS:osbuild-composer-worker-0:75-12.el8_8.x86_64"
        },
        "product_reference": "osbuild-composer-worker-0:75-12.el8_8.x86_64",
        "relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "osbuild-composer-worker-debuginfo-0:75-12.el8_8.x86_64 as a component of Red Hat Enterprise Linux AppStream TUS (v.8.8)",
          "product_id": "AppStream-8.8.0.Z.TUS:osbuild-composer-worker-debuginfo-0:75-12.el8_8.x86_64"
        },
        "product_reference": "osbuild-composer-worker-debuginfo-0:75-12.el8_8.x86_64",
        "relates_to_product_reference": "AppStream-8.8.0.Z.TUS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-25681",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation"
      },
      "discovery_date": "2026-05-22T16:01:08.177603+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2480761"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in golang.org/x/net/html. A remote attacker could exploit this vulnerability by providing specially crafted HTML. When this arbitrary HTML is parsed and rendered, it can result in an unexpected HTML tree, bypassing input sanitization. This can be leveraged to execute Cross-Site Scripting (XSS) attacks, potentially leading to arbitrary code execution in applications that use the affected component.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important vulnerability in `golang.org/x/net/html` could enable remote attackers to execute Cross-Site Scripting (XSS) attacks, potentially leading to arbitrary code execution. The flaw allows specially crafted HTML to bypass input sanitization during parsing and rendering. Red Hat products are affected if they process untrusted HTML content using the vulnerable component without additional output encoding or robust content security policies.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.8.0.Z.E4S:osbuild-composer-0:75-12.el8_8.ppc64le",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-0:75-12.el8_8.src",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-core-0:75-12.el8_8.ppc64le",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-core-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-core-debuginfo-0:75-12.el8_8.ppc64le",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-core-debuginfo-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-debuginfo-0:75-12.el8_8.ppc64le",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-debuginfo-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-debugsource-0:75-12.el8_8.ppc64le",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-debugsource-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-dnf-json-0:75-12.el8_8.ppc64le",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-dnf-json-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-tests-debuginfo-0:75-12.el8_8.ppc64le",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-tests-debuginfo-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-0:75-12.el8_8.ppc64le",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-debuginfo-0:75-12.el8_8.ppc64le",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-debuginfo-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.TUS:osbuild-composer-0:75-12.el8_8.src",
          "AppStream-8.8.0.Z.TUS:osbuild-composer-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.TUS:osbuild-composer-core-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.TUS:osbuild-composer-core-debuginfo-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.TUS:osbuild-composer-debuginfo-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.TUS:osbuild-composer-debugsource-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.TUS:osbuild-composer-dnf-json-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.TUS:osbuild-composer-tests-debuginfo-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.TUS:osbuild-composer-worker-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.TUS:osbuild-composer-worker-debuginfo-0:75-12.el8_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-25681"
        },
        {
          "category": "external",
          "summary": "RHBZ#2480761",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480761"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-25681",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-25681"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25681",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25681"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/781703",
          "url": "https://go.dev/cl/781703"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/79574",
          "url": "https://go.dev/issue/79574"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8",
          "url": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-5029",
          "url": "https://pkg.go.dev/vuln/GO-2026-5029"
        }
      ],
      "release_date": "2026-05-22T15:01:21.975000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-26T18:45:32+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.8.0.Z.E4S:osbuild-composer-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-0:75-12.el8_8.src",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-core-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-core-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-core-debuginfo-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-core-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-debuginfo-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-debugsource-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-debugsource-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-dnf-json-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-dnf-json-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-tests-debuginfo-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-tests-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-debuginfo-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-0:75-12.el8_8.src",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-core-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-core-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-debugsource-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-dnf-json-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-tests-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-worker-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-worker-debuginfo-0:75-12.el8_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:90363"
        },
        {
          "category": "workaround",
          "details": "To mitigate this flaw, applications processing untrusted HTML input must implement strict input sanitization and ensure all output is properly encoded before rendering. Deploying a comprehensive Content Security Policy (CSP) can restrict script execution, further reducing the attack surface. Administrators should review application configurations to ensure adequate protection against XSS.",
          "product_ids": [
            "AppStream-8.8.0.Z.E4S:osbuild-composer-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-0:75-12.el8_8.src",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-core-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-core-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-core-debuginfo-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-core-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-debuginfo-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-debugsource-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-debugsource-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-dnf-json-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-dnf-json-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-tests-debuginfo-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-tests-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-debuginfo-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-0:75-12.el8_8.src",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-core-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-core-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-debugsource-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-dnf-json-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-tests-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-worker-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-worker-debuginfo-0:75-12.el8_8.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.8.0.Z.E4S:osbuild-composer-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-0:75-12.el8_8.src",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-core-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-core-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-core-debuginfo-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-core-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-debuginfo-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-debugsource-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-debugsource-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-dnf-json-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-dnf-json-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-tests-debuginfo-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-tests-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-debuginfo-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-0:75-12.el8_8.src",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-core-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-core-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-debugsource-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-dnf-json-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-tests-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-worker-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-worker-debuginfo-0:75-12.el8_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting"
    },
    {
      "cve": "CVE-2026-27136",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation"
      },
      "discovery_date": "2026-05-22T16:00:56.609820+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2480757"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in golang.org/x/net/html. When arbitrary HTML is parsed and then rendered, it can result in an unexpected HTML tree. This allows an attacker to bypass HTML sanitization mechanisms, leading to Cross-Site Scripting (XSS) attacks in applications. Such attacks can result in information disclosure or arbitrary code execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability in `golang.org/x/net/html` is rated as Important. It allows for Cross-Site Scripting (XSS) attacks by enabling an attacker to bypass HTML sanitization mechanisms when arbitrary HTML is parsed and rendered. This can lead to information disclosure or arbitrary code execution in affected applications. Exploitation typically requires user interaction, where a user processes specially crafted malicious HTML content.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.8.0.Z.E4S:osbuild-composer-0:75-12.el8_8.ppc64le",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-0:75-12.el8_8.src",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-core-0:75-12.el8_8.ppc64le",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-core-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-core-debuginfo-0:75-12.el8_8.ppc64le",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-core-debuginfo-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-debuginfo-0:75-12.el8_8.ppc64le",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-debuginfo-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-debugsource-0:75-12.el8_8.ppc64le",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-debugsource-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-dnf-json-0:75-12.el8_8.ppc64le",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-dnf-json-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-tests-debuginfo-0:75-12.el8_8.ppc64le",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-tests-debuginfo-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-0:75-12.el8_8.ppc64le",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-debuginfo-0:75-12.el8_8.ppc64le",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-debuginfo-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.TUS:osbuild-composer-0:75-12.el8_8.src",
          "AppStream-8.8.0.Z.TUS:osbuild-composer-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.TUS:osbuild-composer-core-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.TUS:osbuild-composer-core-debuginfo-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.TUS:osbuild-composer-debuginfo-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.TUS:osbuild-composer-debugsource-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.TUS:osbuild-composer-dnf-json-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.TUS:osbuild-composer-tests-debuginfo-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.TUS:osbuild-composer-worker-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.TUS:osbuild-composer-worker-debuginfo-0:75-12.el8_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-27136"
        },
        {
          "category": "external",
          "summary": "RHBZ#2480757",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480757"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-27136",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-27136"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27136",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27136"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/781685",
          "url": "https://go.dev/cl/781685"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/79575",
          "url": "https://go.dev/issue/79575"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8",
          "url": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-5030",
          "url": "https://pkg.go.dev/vuln/GO-2026-5030"
        }
      ],
      "release_date": "2026-05-22T15:01:22.111000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-26T18:45:32+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.8.0.Z.E4S:osbuild-composer-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-0:75-12.el8_8.src",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-core-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-core-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-core-debuginfo-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-core-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-debuginfo-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-debugsource-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-debugsource-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-dnf-json-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-dnf-json-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-tests-debuginfo-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-tests-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-debuginfo-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-0:75-12.el8_8.src",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-core-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-core-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-debugsource-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-dnf-json-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-tests-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-worker-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-worker-debuginfo-0:75-12.el8_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:90363"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-8.8.0.Z.E4S:osbuild-composer-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-0:75-12.el8_8.src",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-core-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-core-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-core-debuginfo-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-core-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-debuginfo-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-debugsource-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-debugsource-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-dnf-json-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-dnf-json-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-tests-debuginfo-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-tests-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-debuginfo-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-0:75-12.el8_8.src",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-core-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-core-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-debugsource-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-dnf-json-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-tests-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-worker-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-worker-debuginfo-0:75-12.el8_8.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.8.0.Z.E4S:osbuild-composer-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-0:75-12.el8_8.src",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-core-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-core-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-core-debuginfo-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-core-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-debuginfo-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-debugsource-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-debugsource-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-dnf-json-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-dnf-json-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-tests-debuginfo-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-tests-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-debuginfo-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-0:75-12.el8_8.src",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-core-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-core-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-debugsource-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-dnf-json-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-tests-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-worker-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-worker-debuginfo-0:75-12.el8_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass"
    },
    {
      "cve": "CVE-2026-33186",
      "cwe": {
        "id": "CWE-551",
        "name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
      },
      "discovery_date": "2026-03-20T23:02:27.802640+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2449833"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as an Important severity impact for Red Hat because remote unauthenticated attackers could bypass access restrictions, potentially compromising service integrity and exposing sensitive internal data across affected endpoints. To successfully exploit this issue, services must implement path-based authorization interceptors that enforce specific deny rules while permitting other requests through a fallback allow configuration. Typical Red Hat product deployments configure components with strict default-deny policies or transport-level mutual TLS, restricting the practical attack surface to non-standard environments.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.8.0.Z.E4S:osbuild-composer-0:75-12.el8_8.ppc64le",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-0:75-12.el8_8.src",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-core-0:75-12.el8_8.ppc64le",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-core-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-core-debuginfo-0:75-12.el8_8.ppc64le",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-core-debuginfo-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-debuginfo-0:75-12.el8_8.ppc64le",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-debuginfo-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-debugsource-0:75-12.el8_8.ppc64le",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-debugsource-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-dnf-json-0:75-12.el8_8.ppc64le",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-dnf-json-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-tests-debuginfo-0:75-12.el8_8.ppc64le",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-tests-debuginfo-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-0:75-12.el8_8.ppc64le",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-debuginfo-0:75-12.el8_8.ppc64le",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-debuginfo-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.TUS:osbuild-composer-0:75-12.el8_8.src",
          "AppStream-8.8.0.Z.TUS:osbuild-composer-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.TUS:osbuild-composer-core-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.TUS:osbuild-composer-core-debuginfo-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.TUS:osbuild-composer-debuginfo-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.TUS:osbuild-composer-debugsource-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.TUS:osbuild-composer-dnf-json-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.TUS:osbuild-composer-tests-debuginfo-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.TUS:osbuild-composer-worker-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.TUS:osbuild-composer-worker-debuginfo-0:75-12.el8_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-33186"
        },
        {
          "category": "external",
          "summary": "RHBZ#2449833",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449833"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-33186",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-33186"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186"
        },
        {
          "category": "external",
          "summary": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3",
          "url": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3"
        }
      ],
      "release_date": "2026-03-20T22:23:32.147000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-26T18:45:32+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.8.0.Z.E4S:osbuild-composer-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-0:75-12.el8_8.src",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-core-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-core-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-core-debuginfo-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-core-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-debuginfo-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-debugsource-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-debugsource-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-dnf-json-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-dnf-json-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-tests-debuginfo-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-tests-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-debuginfo-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-0:75-12.el8_8.src",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-core-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-core-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-debugsource-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-dnf-json-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-tests-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-worker-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-worker-debuginfo-0:75-12.el8_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:90363"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.",
          "product_ids": [
            "AppStream-8.8.0.Z.E4S:osbuild-composer-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-0:75-12.el8_8.src",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-core-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-core-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-core-debuginfo-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-core-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-debuginfo-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-debugsource-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-debugsource-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-dnf-json-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-dnf-json-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-tests-debuginfo-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-tests-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-debuginfo-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-0:75-12.el8_8.src",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-core-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-core-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-debugsource-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-dnf-json-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-tests-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-worker-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-worker-debuginfo-0:75-12.el8_8.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.8.0.Z.E4S:osbuild-composer-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-0:75-12.el8_8.src",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-core-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-core-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-core-debuginfo-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-core-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-debuginfo-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-debugsource-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-debugsource-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-dnf-json-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-dnf-json-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-tests-debuginfo-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-tests-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-debuginfo-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-0:75-12.el8_8.src",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-core-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-core-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-debugsource-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-dnf-json-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-tests-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-worker-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-worker-debuginfo-0:75-12.el8_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation"
    },
    {
      "cve": "CVE-2026-42502",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation"
      },
      "discovery_date": "2026-05-22T16:01:11.151484+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2480762"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in golang.org/x/net/html. This vulnerability allows an attacker to manipulate how HTML is processed and displayed. By providing specially crafted HTML, an attacker can cause an unexpected structure in the rendered output. This can lead to Cross-Site Scripting (XSS) attacks, where malicious scripts are executed in a user\u0027s web browser, potentially compromising user data or taking control of their session.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw in golang.org/x/net/html can lead to Cross-Site Scripting (XSS) in applications that parse and render untrusted HTML, even with sanitization attempts. This is due to an unexpected HTML tree structure, allowing malicious scripts to execute in a user\u0027s browser.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.8.0.Z.E4S:osbuild-composer-0:75-12.el8_8.ppc64le",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-0:75-12.el8_8.src",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-core-0:75-12.el8_8.ppc64le",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-core-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-core-debuginfo-0:75-12.el8_8.ppc64le",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-core-debuginfo-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-debuginfo-0:75-12.el8_8.ppc64le",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-debuginfo-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-debugsource-0:75-12.el8_8.ppc64le",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-debugsource-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-dnf-json-0:75-12.el8_8.ppc64le",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-dnf-json-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-tests-debuginfo-0:75-12.el8_8.ppc64le",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-tests-debuginfo-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-0:75-12.el8_8.ppc64le",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-debuginfo-0:75-12.el8_8.ppc64le",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-debuginfo-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.TUS:osbuild-composer-0:75-12.el8_8.src",
          "AppStream-8.8.0.Z.TUS:osbuild-composer-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.TUS:osbuild-composer-core-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.TUS:osbuild-composer-core-debuginfo-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.TUS:osbuild-composer-debuginfo-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.TUS:osbuild-composer-debugsource-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.TUS:osbuild-composer-dnf-json-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.TUS:osbuild-composer-tests-debuginfo-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.TUS:osbuild-composer-worker-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.TUS:osbuild-composer-worker-debuginfo-0:75-12.el8_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-42502"
        },
        {
          "category": "external",
          "summary": "RHBZ#2480762",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480762"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-42502",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42502"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42502",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42502"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/781701",
          "url": "https://go.dev/cl/781701"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/79572",
          "url": "https://go.dev/issue/79572"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8",
          "url": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-5027",
          "url": "https://pkg.go.dev/vuln/GO-2026-5027"
        }
      ],
      "release_date": "2026-05-22T15:01:21.649000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-26T18:45:32+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.8.0.Z.E4S:osbuild-composer-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-0:75-12.el8_8.src",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-core-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-core-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-core-debuginfo-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-core-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-debuginfo-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-debugsource-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-debugsource-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-dnf-json-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-dnf-json-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-tests-debuginfo-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-tests-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-debuginfo-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-0:75-12.el8_8.src",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-core-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-core-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-debugsource-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-dnf-json-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-tests-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-worker-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-worker-debuginfo-0:75-12.el8_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:90363"
        },
        {
          "category": "workaround",
          "details": "Applications utilizing `golang.org/x/net/html` should implement robust sanitization of all untrusted HTML input before rendering to prevent the creation of unexpected HTML structures that could facilitate XSS attacks. If an application does not require rendering arbitrary HTML, it should avoid processing such input.",
          "product_ids": [
            "AppStream-8.8.0.Z.E4S:osbuild-composer-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-0:75-12.el8_8.src",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-core-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-core-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-core-debuginfo-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-core-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-debuginfo-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-debugsource-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-debugsource-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-dnf-json-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-dnf-json-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-tests-debuginfo-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-tests-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-debuginfo-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-0:75-12.el8_8.src",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-core-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-core-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-debugsource-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-dnf-json-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-tests-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-worker-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-worker-debuginfo-0:75-12.el8_8.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.8.0.Z.E4S:osbuild-composer-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-0:75-12.el8_8.src",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-core-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-core-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-core-debuginfo-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-core-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-debuginfo-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-debugsource-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-debugsource-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-dnf-json-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-dnf-json-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-tests-debuginfo-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-tests-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-debuginfo-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-0:75-12.el8_8.src",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-core-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-core-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-debugsource-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-dnf-json-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-tests-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-worker-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-worker-debuginfo-0:75-12.el8_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering"
    },
    {
      "cve": "CVE-2026-55677",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory"
      },
      "discovery_date": "2026-06-26T17:01:45.110038+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2493622"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Echo, a Go web framework. An attacker can exploit a disagreement in URL path decoding between the router and the static file handler. The router processes raw encoded paths, while the static file handler unescapes encoded forward slashes. This allows an attacker to bypass route-level access controls, leading to unauthorized information disclosure by reading static files.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "github.com/labstack/echo: Echo: Unauthorized Information Disclosure via URL Path Decoding Discrepancy",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important information disclosure flaw in the Echo web framework. The discrepancy in URL path decoding between the router and static file handler allows an unauthenticated attacker to bypass access controls and read arbitrary static files. This could lead to the exposure of sensitive data hosted on affected Red Hat products utilizing the Echo framework for serving static content.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.8.0.Z.E4S:osbuild-composer-0:75-12.el8_8.ppc64le",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-0:75-12.el8_8.src",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-core-0:75-12.el8_8.ppc64le",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-core-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-core-debuginfo-0:75-12.el8_8.ppc64le",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-core-debuginfo-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-debuginfo-0:75-12.el8_8.ppc64le",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-debuginfo-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-debugsource-0:75-12.el8_8.ppc64le",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-debugsource-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-dnf-json-0:75-12.el8_8.ppc64le",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-dnf-json-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-tests-debuginfo-0:75-12.el8_8.ppc64le",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-tests-debuginfo-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-0:75-12.el8_8.ppc64le",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-debuginfo-0:75-12.el8_8.ppc64le",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-debuginfo-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.TUS:osbuild-composer-0:75-12.el8_8.src",
          "AppStream-8.8.0.Z.TUS:osbuild-composer-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.TUS:osbuild-composer-core-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.TUS:osbuild-composer-core-debuginfo-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.TUS:osbuild-composer-debuginfo-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.TUS:osbuild-composer-debugsource-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.TUS:osbuild-composer-dnf-json-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.TUS:osbuild-composer-tests-debuginfo-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.TUS:osbuild-composer-worker-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.TUS:osbuild-composer-worker-debuginfo-0:75-12.el8_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-55677"
        },
        {
          "category": "external",
          "summary": "RHBZ#2493622",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493622"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-55677",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-55677"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-55677",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55677"
        },
        {
          "category": "external",
          "summary": "https://github.com/labstack/echo/security/advisories/GHSA-vfp3-v2gw-7wfq",
          "url": "https://github.com/labstack/echo/security/advisories/GHSA-vfp3-v2gw-7wfq"
        }
      ],
      "release_date": "2026-06-26T16:15:55.633000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-26T18:45:32+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.8.0.Z.E4S:osbuild-composer-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-0:75-12.el8_8.src",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-core-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-core-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-core-debuginfo-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-core-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-debuginfo-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-debugsource-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-debugsource-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-dnf-json-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-dnf-json-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-tests-debuginfo-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-tests-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-debuginfo-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-0:75-12.el8_8.src",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-core-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-core-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-debugsource-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-dnf-json-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-tests-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-worker-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-worker-debuginfo-0:75-12.el8_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:90363"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "AppStream-8.8.0.Z.E4S:osbuild-composer-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-0:75-12.el8_8.src",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-core-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-core-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-core-debuginfo-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-core-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-debuginfo-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-debugsource-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-debugsource-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-dnf-json-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-dnf-json-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-tests-debuginfo-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-tests-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-debuginfo-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-0:75-12.el8_8.src",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-core-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-core-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-debugsource-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-dnf-json-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-tests-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-worker-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-worker-debuginfo-0:75-12.el8_8.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.8.0.Z.E4S:osbuild-composer-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-0:75-12.el8_8.src",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-core-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-core-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-core-debuginfo-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-core-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-debuginfo-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-debugsource-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-debugsource-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-dnf-json-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-dnf-json-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-tests-debuginfo-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-tests-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-debuginfo-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-0:75-12.el8_8.src",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-core-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-core-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-debugsource-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-dnf-json-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-tests-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-worker-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-worker-debuginfo-0:75-12.el8_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "github.com/labstack/echo: Echo: Unauthorized Information Disclosure via URL Path Decoding Discrepancy"
    },
    {
      "cve": "CVE-2026-111943",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "discovery_date": "2026-10-20T09:38:36.160000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2556068"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Go\u0027s crypto/x509 package. The certificate verification process fails to block trust in intermediate certificates associated with a compromised Certificate Authority (CA). A remote attacker presenting a certificate signed by these intermediate authorities can impersonate legitimate servers during secure connections. This flaw can enable an attacker to conduct a man-in-the-middle (MitM) attack to intercept or alter confidential communications.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated Important because Go applications validating TLS certificates could accept unauthorized certificates issued by distrusted intermediate Certificate Authorities, potentially compromising the integrity and confidentiality of secure network communications. Any Go-based client or server relying on standard certificate verification may be exposed to man-in-the-middle attacks if an attacker intercepts traffic using certificates derived from these intermediate keys. Exploitation requires specific network positioning and certificates generated by the untrusted intermediate authorities, limiting opportunistic widespread abuse.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "AppStream-8.8.0.Z.E4S:osbuild-composer-0:75-12.el8_8.ppc64le",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-0:75-12.el8_8.src",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-core-0:75-12.el8_8.ppc64le",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-core-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-core-debuginfo-0:75-12.el8_8.ppc64le",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-core-debuginfo-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-debuginfo-0:75-12.el8_8.ppc64le",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-debuginfo-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-debugsource-0:75-12.el8_8.ppc64le",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-debugsource-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-dnf-json-0:75-12.el8_8.ppc64le",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-dnf-json-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-tests-debuginfo-0:75-12.el8_8.ppc64le",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-tests-debuginfo-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-0:75-12.el8_8.ppc64le",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-debuginfo-0:75-12.el8_8.ppc64le",
          "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-debuginfo-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.TUS:osbuild-composer-0:75-12.el8_8.src",
          "AppStream-8.8.0.Z.TUS:osbuild-composer-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.TUS:osbuild-composer-core-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.TUS:osbuild-composer-core-debuginfo-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.TUS:osbuild-composer-debuginfo-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.TUS:osbuild-composer-debugsource-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.TUS:osbuild-composer-dnf-json-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.TUS:osbuild-composer-tests-debuginfo-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.TUS:osbuild-composer-worker-0:75-12.el8_8.x86_64",
          "AppStream-8.8.0.Z.TUS:osbuild-composer-worker-debuginfo-0:75-12.el8_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-111943"
        },
        {
          "category": "external",
          "summary": "RHBZ#2556068",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556068"
        },
        {
          "category": "external",
          "summary": "RHSB-2026-012",
          "url": "https://access.redhat.com/security/vulnerabilities/RHSB-2026-012"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-111943",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-111943"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-111943",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111943"
        },
        {
          "category": "external",
          "summary": "https://github.com/golang/go/issues/82345",
          "url": "https://github.com/golang/go/issues/82345"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-nuts/c/K22sG2AYnKU",
          "url": "https://groups.google.com/g/golang-nuts/c/K22sG2AYnKU"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6809",
          "url": "https://pkg.go.dev/vuln/GO-2026-6809"
        }
      ],
      "release_date": "2026-10-20T02:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-10-26T18:45:32+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "AppStream-8.8.0.Z.E4S:osbuild-composer-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-0:75-12.el8_8.src",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-core-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-core-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-core-debuginfo-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-core-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-debuginfo-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-debugsource-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-debugsource-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-dnf-json-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-dnf-json-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-tests-debuginfo-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-tests-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-debuginfo-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-0:75-12.el8_8.src",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-core-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-core-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-debugsource-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-dnf-json-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-tests-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-worker-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-worker-debuginfo-0:75-12.el8_8.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:90363"
        },
        {
          "category": "workaround",
          "details": "See the security bulletin for a detailed mitigation procedure.",
          "product_ids": [
            "AppStream-8.8.0.Z.E4S:osbuild-composer-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-0:75-12.el8_8.src",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-core-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-core-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-core-debuginfo-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-core-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-debuginfo-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-debugsource-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-debugsource-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-dnf-json-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-dnf-json-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-tests-debuginfo-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-tests-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-debuginfo-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-0:75-12.el8_8.src",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-core-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-core-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-debugsource-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-dnf-json-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-tests-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-worker-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-worker-debuginfo-0:75-12.el8_8.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "AppStream-8.8.0.Z.E4S:osbuild-composer-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-0:75-12.el8_8.src",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-core-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-core-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-core-debuginfo-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-core-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-debuginfo-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-debugsource-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-debugsource-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-dnf-json-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-dnf-json-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-tests-debuginfo-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-tests-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-debuginfo-0:75-12.el8_8.ppc64le",
            "AppStream-8.8.0.Z.E4S:osbuild-composer-worker-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-0:75-12.el8_8.src",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-core-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-core-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-debugsource-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-dnf-json-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-tests-debuginfo-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-worker-0:75-12.el8_8.x86_64",
            "AppStream-8.8.0.Z.TUS:osbuild-composer-worker-debuginfo-0:75-12.el8_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.


Loading…

Loading…

Loading…

Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON
How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Events included in the timeline

Loading timeline…


    Loading…

    Loading…

    Loading…

    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.