GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration
Search

Find a vulnerability

Search criteria

    5802 vulnerabilities by RED HAT

    CVE-2026-76925 (GCVE-0-2026-76925)

    Vulnerability from nvd – Published: 2026-09-04 21:02 – Updated: 2026-09-04 21:02
    VLAI
    Title
    Flatpak: flatpak: toctou race condition allows symlink redirection
    Summary
    A flaw was found in Flatpak. A Time-of-check to time-of-use (TOCTOU) race condition exists in the `org.freedesktop.Flatpak.SystemHelper` component. This vulnerability occurs because a privileged `chmod` operation executes before the OSTree repository validation within the `Deploy()` function. An attacker can exploit this timing window to redirect symlinks to arbitrary files, potentially leading to unauthorized file manipulation or information disclosure.
    CWE
    • CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition
    References
    URL Tags
    https://access.redhat.com/security/cve/CVE-2026-76925 vdb-entryx_refsource_REDHAT
    https://bugzilla.redhat.com/show_bug.cgi?id=2520099 issue-trackingx_refsource_REDHAT
    Impacted products
    Date Public
    2026-08-19 00:00
    Show details on NVD website

    {
      "containers": {
        "cna": {
          "affected": [
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:10"
              ],
              "defaultStatus": "affected",
              "packageName": "flatpak",
              "product": "Red Hat Enterprise Linux 10",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:7"
              ],
              "defaultStatus": "affected",
              "packageName": "flatpak",
              "product": "Red Hat Enterprise Linux 7",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:8"
              ],
              "defaultStatus": "affected",
              "packageName": "flatpak",
              "product": "Red Hat Enterprise Linux 8",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:9"
              ],
              "defaultStatus": "affected",
              "packageName": "flatpak",
              "product": "Red Hat Enterprise Linux 9",
              "vendor": "Red Hat"
            }
          ],
          "datePublic": "2026-08-19T00:00:00.000Z",
          "descriptions": [
            {
              "lang": "en",
              "value": "A flaw was found in Flatpak. A Time-of-check to time-of-use (TOCTOU) race condition exists in the `org.freedesktop.Flatpak.SystemHelper` component. This vulnerability occurs because a privileged `chmod` operation executes before the OSTree repository validation within the `Deploy()` function. An attacker can exploit this timing window to redirect symlinks to arbitrary files, potentially leading to unauthorized file manipulation or information disclosure."
            }
          ],
          "metrics": [
            {
              "other": {
                "content": {
                  "namespace": "https://access.redhat.com/security/updates/classification/",
                  "value": "Moderate"
                },
                "type": "Red Hat severity rating"
              }
            },
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "LOCAL",
                "availabilityImpact": "LOW",
                "baseScore": 5.8,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "LOW",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L",
                "version": "3.1"
              },
              "format": "CVSS"
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-367",
                  "description": "Time-of-check Time-of-use (TOCTOU) Race Condition",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-04T21:02:00.079Z",
            "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
            "shortName": "redhat"
          },
          "references": [
            {
              "tags": [
                "vdb-entry",
                "x_refsource_REDHAT"
              ],
              "url": "https://access.redhat.com/security/cve/CVE-2026-76925"
            },
            {
              "name": "RHBZ#2520099",
              "tags": [
                "issue-tracking",
                "x_refsource_REDHAT"
              ],
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2520099"
            }
          ],
          "timeline": [
            {
              "lang": "en",
              "time": "2026-08-19T22:56:29.378Z",
              "value": "Reported to Red Hat."
            },
            {
              "lang": "en",
              "time": "2026-08-19T00:00:00.000Z",
              "value": "Made public."
            }
          ],
          "title": "Flatpak: flatpak: toctou race condition allows symlink redirection",
          "x_generator": {
            "engine": "cvelib 1.8.0"
          },
          "x_redhatCweChain": "CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "assignerShortName": "redhat",
        "cveId": "CVE-2026-76925",
        "datePublished": "2026-09-04T21:02:00.079Z",
        "dateReserved": "2026-08-19T22:57:38.204Z",
        "dateUpdated": "2026-09-04T21:02:00.079Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-85769 (GCVE-0-2026-85769)

    Vulnerability from nvd – Published: 2026-09-04 17:48 – Updated: 2026-09-04 18:51
    VLAI
    Title
    Libtpms: libtpms: heap out-of-bounds read in tpm2 state unmarshalling via unchecked block_skip_read() blocksize
    Summary
    A flaw was found in libtpms, a library that provides software TPM 2.0 emulation. When restoring TPM 2.0 state (for example during a virtual machine's power-on or state/migration restore), a malformed state blob can supply an oversized skip-block length that is not validated against the remaining size of the input buffer. This can drive an internal size counter negative, which bypasses a subsequent bounds check due to an unsafe signed-to-unsigned conversion, causing the parser to read memory outside the bounds of the heap buffer holding the state data. Successful exploitation can crash the process hosting libtpms (such as swtpm), resulting in a denial of service of the emulated TPM device and the virtual machine that depends on it. No data corruption or information disclosure was confirmed.
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-04 18:51 UTC
    CWE
    Impacted products
    Vendor Product Version
    Red Hat Red Hat Enterprise Linux 10     cpe:/o:redhat:enterprise_linux:10
    Create a notification for this product.
    Red Hat Red Hat Enterprise Linux 8     cpe:/o:redhat:enterprise_linux:8
    Create a notification for this product.
    Red Hat Red Hat Enterprise Linux 9     cpe:/o:redhat:enterprise_linux:9
    Create a notification for this product.
    Date Public
    2026-09-04 00:00
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-85769",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-04T18:51:03.667125Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-04T18:51:12.453Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:10"
              ],
              "defaultStatus": "affected",
              "packageName": "libtpms",
              "product": "Red Hat Enterprise Linux 10",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:8"
              ],
              "defaultStatus": "affected",
              "packageName": "virt:rhel/libtpms",
              "product": "Red Hat Enterprise Linux 8",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:9"
              ],
              "defaultStatus": "affected",
              "packageName": "libtpms",
              "product": "Red Hat Enterprise Linux 9",
              "vendor": "Red Hat"
            }
          ],
          "credits": [
            {
              "lang": "en",
              "value": "Red Hat would like to thank Isuka Sanuj (CyberCrew Inc. (\u682a\u5f0f\u4f1a\u793eCyberCrew)) and Leyao (ICT CAS) for reporting this issue."
            }
          ],
          "datePublic": "2026-09-04T00:00:00.000Z",
          "descriptions": [
            {
              "lang": "en",
              "value": "A flaw was found in libtpms, a library that provides software TPM 2.0 emulation. When restoring TPM 2.0 state (for example during a virtual machine\u0027s power-on or state/migration restore), a malformed state blob can supply an oversized skip-block length that is not validated against the remaining size of the input buffer. This can drive an internal size counter negative, which bypasses a subsequent bounds check due to an unsafe signed-to-unsigned conversion, causing the parser to read memory outside the bounds of the heap buffer holding the state data. Successful exploitation can crash the process hosting libtpms (such as swtpm), resulting in a denial of service of the emulated TPM device and the virtual machine that depends on it. No data corruption or information disclosure was confirmed."
            }
          ],
          "metrics": [
            {
              "other": {
                "content": {
                  "namespace": "https://access.redhat.com/security/updates/classification/",
                  "value": "Moderate"
                },
                "type": "Red Hat severity rating"
              }
            },
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 6.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "format": "CVSS"
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-125",
                  "description": "Out-of-bounds Read",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-04T17:48:13.674Z",
            "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
            "shortName": "redhat"
          },
          "references": [
            {
              "tags": [
                "vdb-entry",
                "x_refsource_REDHAT"
              ],
              "url": "https://access.redhat.com/security/cve/CVE-2026-85769"
            },
            {
              "name": "RHBZ#2528538",
              "tags": [
                "issue-tracking",
                "x_refsource_REDHAT"
              ],
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528538"
            },
            {
              "url": "https://github.com/stefanberger/libtpms/commit/b1462888180d896af03cae0487e8d45009cc445e"
            },
            {
              "url": "https://github.com/stefanberger/libtpms/issues/614"
            }
          ],
          "timeline": [
            {
              "lang": "en",
              "time": "2026-09-01T00:00:00.000Z",
              "value": "Reported to Red Hat."
            },
            {
              "lang": "en",
              "time": "2026-09-04T00:00:00.000Z",
              "value": "Made public."
            }
          ],
          "title": "Libtpms: libtpms: heap out-of-bounds read in tpm2 state unmarshalling via unchecked block_skip_read() blocksize",
          "workarounds": [
            {
              "lang": "en",
              "value": "No mitigation is currently available that meets Red Hat Product Security\u0027s standards for usability, deployment, applicability, or stability."
            }
          ],
          "x_generator": {
            "engine": "cvelib 1.8.0"
          },
          "x_redhatCweChain": "CWE-125: Out-of-bounds Read"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "assignerShortName": "redhat",
        "cveId": "CVE-2026-85769",
        "datePublished": "2026-09-04T17:48:13.674Z",
        "dateReserved": "2026-09-04T15:19:09.987Z",
        "dateUpdated": "2026-09-04T18:51:12.453Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-85534 (GCVE-0-2026-85534)

    Vulnerability from nvd – Published: 2026-09-04 10:19 – Updated: 2026-09-04 16:07
    VLAI
    Title
    Libsoup: libsoup: http/2 client crash in on_data_source_read_callback when settings initial_window_size shrinks during deferred body read
    Summary
    A flaw was found in libsoup. When a client sends an HTTP/2 request body from a non-pollable input stream, the library can buffer more data than the current flow-control window later allows. A malicious HTTP/2 server can shrink SETTINGS_INITIAL_WINDOW_SIZE while that buffered read is still in progress. The client then copies the full buffer into a smaller DATA callback without a runtime bounds check, which can abort the process or fail the HTTP/2 session.
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-04 16:07 UTC
    CWE
    Impacted products
    Date Public
    2026-09-03 00:00
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-85534",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-04T16:07:03.334905Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-04T16:07:27.046Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:10"
              ],
              "defaultStatus": "affected",
              "packageName": "libsoup3",
              "product": "Red Hat Enterprise Linux 10",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:6"
              ],
              "defaultStatus": "unaffected",
              "packageName": "libsoup",
              "product": "Red Hat Enterprise Linux 6",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:7"
              ],
              "defaultStatus": "unaffected",
              "packageName": "libsoup",
              "product": "Red Hat Enterprise Linux 7",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:8"
              ],
              "defaultStatus": "unaffected",
              "packageName": "libsoup",
              "product": "Red Hat Enterprise Linux 8",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:9"
              ],
              "defaultStatus": "unaffected",
              "packageName": "libsoup",
              "product": "Red Hat Enterprise Linux 9",
              "vendor": "Red Hat"
            }
          ],
          "credits": [
            {
              "lang": "en",
              "value": "Red Hat would like to thank xtromera for reporting this issue."
            }
          ],
          "datePublic": "2026-09-03T00:00:00.000Z",
          "descriptions": [
            {
              "lang": "en",
              "value": "A flaw was found in libsoup. When a client sends an HTTP/2 request body from a non-pollable input stream, the library can buffer more data than the current flow-control window later allows. A malicious HTTP/2 server can shrink SETTINGS_INITIAL_WINDOW_SIZE while that buffered read is still in progress. The client then copies the full buffer into a smaller DATA callback without a runtime bounds check, which can abort the process or fail the HTTP/2 session."
            }
          ],
          "metrics": [
            {
              "other": {
                "content": {
                  "namespace": "https://access.redhat.com/security/updates/classification/",
                  "value": "Moderate"
                },
                "type": "Red Hat severity rating"
              }
            },
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 5.9,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "format": "CVSS"
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-617",
                  "description": "Reachable Assertion",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-04T10:19:22.562Z",
            "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
            "shortName": "redhat"
          },
          "references": [
            {
              "tags": [
                "vdb-entry",
                "x_refsource_REDHAT"
              ],
              "url": "https://access.redhat.com/security/cve/CVE-2026-85534"
            },
            {
              "name": "RHBZ#2528440",
              "tags": [
                "issue-tracking",
                "x_refsource_REDHAT"
              ],
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528440"
            },
            {
              "url": "https://gitlab.gnome.org/GNOME/libsoup/-/blob/master/libsoup/http2/soup-client-message-io-http2.c"
            },
            {
              "url": "https://gitlab.gnome.org/GNOME/libsoup/-/work_items/551"
            }
          ],
          "timeline": [
            {
              "lang": "en",
              "time": "2026-09-03T17:19:37.253Z",
              "value": "Reported to Red Hat."
            },
            {
              "lang": "en",
              "time": "2026-09-03T00:00:00.000Z",
              "value": "Made public."
            }
          ],
          "title": "Libsoup: libsoup: http/2 client crash in on_data_source_read_callback when settings initial_window_size shrinks during deferred body read",
          "workarounds": [
            {
              "lang": "en",
              "value": "Do not HTTP/2-upload from non-pollable streams (e.g. GFileInputStream) to untrusted servers. soup_message_set_request_body_from_bytes() is the pollable path. Assertions abort instead of returning an oversized length; that is not a fix."
            }
          ],
          "x_generator": {
            "engine": "cvelib 1.8.0"
          },
          "x_redhatCweChain": "CWE-617: Reachable Assertion"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "assignerShortName": "redhat",
        "cveId": "CVE-2026-85534",
        "datePublished": "2026-09-04T10:19:22.562Z",
        "dateReserved": "2026-09-04T08:57:22.995Z",
        "dateUpdated": "2026-09-04T16:07:27.046Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-81666 (GCVE-0-2026-81666)

    Vulnerability from nvd – Published: 2026-09-04 09:46 – Updated: 2026-09-04 09:46
    VLAI
    Title
    Corosync: corosync: integer overflow in check_memb_commit_token_sanity may bypass message length validation on 32-bit systems
    Summary
    An integer overflow was found in Corosync's handling of membership commit token messages. The length-validation check for these messages can be bypassed on 32-bit systems due to an integer overflow in the calculation of the expected message length, allowing a crafted network packet to trigger an out-of-bounds memory access that crashes the Corosync daemon. This results in a denial of service for the affected cluster node. The overflow does not occur on 64-bit systems, where the length calculation is correctly performed in 64-bit arithmetic.
    CWE
    • CWE-190 - Integer Overflow or Wraparound
    References
    URL Tags
    https://access.redhat.com/security/cve/CVE-2026-81666 vdb-entryx_refsource_REDHAT
    https://bugzilla.redhat.com/show_bug.cgi?id=2524923 issue-trackingx_refsource_REDHAT
    Impacted products
    Date Public
    2026-09-04 08:14
    Show details on NVD website

    {
      "containers": {
        "cna": {
          "affected": [
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:10"
              ],
              "defaultStatus": "affected",
              "packageName": "corosync",
              "product": "Red Hat Enterprise Linux 10",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:7"
              ],
              "defaultStatus": "affected",
              "packageName": "corosync",
              "product": "Red Hat Enterprise Linux 7",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:8"
              ],
              "defaultStatus": "affected",
              "packageName": "corosync",
              "product": "Red Hat Enterprise Linux 8",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:9"
              ],
              "defaultStatus": "affected",
              "packageName": "corosync",
              "product": "Red Hat Enterprise Linux 9",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:openshift:4"
              ],
              "defaultStatus": "affected",
              "packageName": "rhcos",
              "product": "Red Hat OpenShift Container Platform 4",
              "vendor": "Red Hat"
            }
          ],
          "credits": [
            {
              "lang": "en",
              "value": "Red Hat would like to thank Tristan Madani (Talence Security) for reporting this issue."
            }
          ],
          "datePublic": "2026-09-04T08:14:29.525Z",
          "descriptions": [
            {
              "lang": "en",
              "value": "An integer overflow was found in Corosync\u0027s handling of membership commit token messages. The length-validation check for these messages can be bypassed on 32-bit systems due to an integer overflow in the calculation of the expected message length, allowing a crafted network packet to trigger an out-of-bounds memory access that crashes the Corosync daemon. This results in a denial of service for the affected cluster node. The overflow does not occur on 64-bit systems, where the length calculation is correctly performed in 64-bit arithmetic."
            }
          ],
          "metrics": [
            {
              "other": {
                "content": {
                  "namespace": "https://access.redhat.com/security/updates/classification/",
                  "value": "Moderate"
                },
                "type": "Red Hat severity rating"
              }
            },
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 6.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "format": "CVSS"
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-190",
                  "description": "Integer Overflow or Wraparound",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-04T09:46:06.130Z",
            "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
            "shortName": "redhat"
          },
          "references": [
            {
              "tags": [
                "vdb-entry",
                "x_refsource_REDHAT"
              ],
              "url": "https://access.redhat.com/security/cve/CVE-2026-81666"
            },
            {
              "name": "RHBZ#2524923",
              "tags": [
                "issue-tracking",
                "x_refsource_REDHAT"
              ],
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524923"
            }
          ],
          "timeline": [
            {
              "lang": "en",
              "time": "2026-08-23T00:00:00.000Z",
              "value": "Reported to Red Hat."
            },
            {
              "lang": "en",
              "time": "2026-09-04T08:14:29.525Z",
              "value": "Made public."
            }
          ],
          "title": "Corosync: corosync: integer overflow in check_memb_commit_token_sanity may bypass message length validation on 32-bit systems",
          "workarounds": [
            {
              "lang": "en",
              "value": "There is no complete mitigation for this vulnerability short of a fix, but the following steps reduce risk:\n\n1. Ensure cluster message authentication is enabled in corosync.conf (crypto_cipher=aes256, crypto_hash=sha256 with a shared key from corosync-keygen), which is the default when clusters are configured via \u0027pcs cluster setup\u0027, and disabling it (cipher=none/hash=none) is an explicitly unsupported configuration per upstream maintainer guidance.\n2. Restrict network access to the cluster communication ports (default 5405-5412/UDP) to trusted cluster node addresses only.\n3. Where architecturally feasible, prefer 64-bit deployments, since the integer overflow described here does not occur on 64-bit systems."
            }
          ],
          "x_generator": {
            "engine": "cvelib 1.8.0"
          },
          "x_redhatCweChain": "CWE-190: Integer Overflow or Wraparound"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "assignerShortName": "redhat",
        "cveId": "CVE-2026-81666",
        "datePublished": "2026-09-04T09:46:06.130Z",
        "dateReserved": "2026-08-27T10:38:28.793Z",
        "dateUpdated": "2026-09-04T09:46:06.130Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-81665 (GCVE-0-2026-81665)

    Vulnerability from nvd – Published: 2026-09-04 09:05 – Updated: 2026-09-04 18:25
    VLAI
    Title
    Corosync: corosync: heap-based buffer overflow in totempg assembly buffer during fragmented message reassembly
    Summary
    A heap-based buffer overflow was found in Corosync's Totem Process Group (totempg) message reassembly. When processing fragmented multicast messages, the buffer used to reassemble fragments lacks a runtime bounds check in release builds. A network-adjacent attacker able to send crafted multicast protocol messages to the cluster could cause a heap buffer overflow with attacker-controlled data. This can crash the Corosync daemon, causing a denial of service to the entire cluster, and may potentially allow further exploitation given sufficient heap-corruption control.
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-04 17:09 UTC
    CWE
    • CWE-122 - Heap-based Buffer Overflow
    References
    URL Tags
    https://access.redhat.com/security/cve/CVE-2026-81665 vdb-entryx_refsource_REDHAT
    https://bugzilla.redhat.com/show_bug.cgi?id=2524910 issue-trackingx_refsource_REDHAT
    Impacted products
    Date Public
    2026-09-04 08:30
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-81665",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-04T17:09:13.395902Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-04T18:25:16.035Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:10"
              ],
              "defaultStatus": "affected",
              "packageName": "corosync",
              "product": "Red Hat Enterprise Linux 10",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:7"
              ],
              "defaultStatus": "affected",
              "packageName": "corosync",
              "product": "Red Hat Enterprise Linux 7",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:8"
              ],
              "defaultStatus": "affected",
              "packageName": "corosync",
              "product": "Red Hat Enterprise Linux 8",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:9"
              ],
              "defaultStatus": "affected",
              "packageName": "corosync",
              "product": "Red Hat Enterprise Linux 9",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:openshift:4"
              ],
              "defaultStatus": "affected",
              "packageName": "openshift/ose-rhel-coreos-9",
              "product": "Red Hat OpenShift Container Platform 4",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:openshift:4"
              ],
              "defaultStatus": "affected",
              "packageName": "rhcos",
              "product": "Red Hat OpenShift Container Platform 4",
              "vendor": "Red Hat"
            }
          ],
          "credits": [
            {
              "lang": "en",
              "value": "Red Hat would like to thank Tristan Madani (Talence Security) for reporting this issue."
            }
          ],
          "datePublic": "2026-09-04T08:30:05.029Z",
          "descriptions": [
            {
              "lang": "en",
              "value": "A heap-based buffer overflow was found in Corosync\u0027s Totem Process Group (totempg) message reassembly. When processing fragmented multicast messages, the buffer used to reassemble fragments lacks a runtime bounds check in release builds. A network-adjacent attacker able to send crafted multicast protocol messages to the cluster could cause a heap buffer overflow with attacker-controlled data. This can crash the Corosync daemon, causing a denial of service to the entire cluster, and may potentially allow further exploitation given sufficient heap-corruption control."
            }
          ],
          "metrics": [
            {
              "other": {
                "content": {
                  "namespace": "https://access.redhat.com/security/updates/classification/",
                  "value": "Important"
                },
                "type": "Red Hat severity rating"
              }
            },
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "format": "CVSS"
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-122",
                  "description": "Heap-based Buffer Overflow",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-04T09:05:35.890Z",
            "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
            "shortName": "redhat"
          },
          "references": [
            {
              "tags": [
                "vdb-entry",
                "x_refsource_REDHAT"
              ],
              "url": "https://access.redhat.com/security/cve/CVE-2026-81665"
            },
            {
              "name": "RHBZ#2524910",
              "tags": [
                "issue-tracking",
                "x_refsource_REDHAT"
              ],
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524910"
            }
          ],
          "timeline": [
            {
              "lang": "en",
              "time": "2026-08-23T00:00:00.000Z",
              "value": "Reported to Red Hat."
            },
            {
              "lang": "en",
              "time": "2026-09-04T08:30:05.029Z",
              "value": "Made public."
            }
          ],
          "title": "Corosync: corosync: heap-based buffer overflow in totempg assembly buffer during fragmented message reassembly",
          "workarounds": [
            {
              "lang": "en",
              "value": "There is no complete mitigation for this vulnerability short of a fix, but the following steps significantly reduce risk:\n\n1. Ensure cluster message authentication is enabled in corosync.conf: set crypto_cipher to aes256 and crypto_hash to sha256 (or stronger) in the totem {} block, with a shared key generated by corosync-keygen. This is the default when clusters are configured via \u0027pcs cluster setup\u0027, and disabling it (cipher=none/hash=none) is an explicitly unsupported configuration per upstream maintainer guidance.\n2. Restrict network access to the cluster communication ports (default 5405-5412/UDP) to trusted cluster node addresses only, using firewalld or other firewall rules.\n3. Ensure SELinux is running in enforcing mode on cluster nodes to limit the impact of any successful exploitation."
            }
          ],
          "x_generator": {
            "engine": "cvelib 1.8.0"
          },
          "x_redhatCweChain": "CWE-122: Heap-based Buffer Overflow"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "assignerShortName": "redhat",
        "cveId": "CVE-2026-81665",
        "datePublished": "2026-09-04T09:05:35.890Z",
        "dateReserved": "2026-08-27T10:38:28.793Z",
        "dateUpdated": "2026-09-04T18:25:16.035Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-85197 (GCVE-0-2026-85197)

    Vulnerability from nvd – Published: 2026-09-04 07:34 – Updated: 2026-09-04 18:15
    VLAI
    Title
    Libsoup: libsoup: heap use-after-free in libsoup http/2 client on_data_read() via goaway during body upload
    Summary
    A flaw was found in libsoup. A malicious HTTP/2 server or a Man-in-the-Middle (MITM) attacker can exploit a heap use-after-free vulnerability in the HTTP/2 client implementation. This occurs when a GNOME application uploads a file using HTTP/2, and the server sends a GOAWAY frame while the file body is being read asynchronously. This can lead to memory corruption, potentially resulting in information disclosure or arbitrary code execution.
    SSVC
    Exploitation: poc Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-04 18:15 UTC
    CWE
    Impacted products
    Date Public
    2026-09-03 13:00
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-85197",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-04T18:15:03.474491Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-04T18:15:28.916Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://gitlab.gnome.org/GNOME/libsoup/-/work_items/552"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:10"
              ],
              "defaultStatus": "affected",
              "packageName": "libsoup3",
              "product": "Red Hat Enterprise Linux 10",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:6"
              ],
              "defaultStatus": "unaffected",
              "packageName": "libsoup",
              "product": "Red Hat Enterprise Linux 6",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:7"
              ],
              "defaultStatus": "unaffected",
              "packageName": "libsoup",
              "product": "Red Hat Enterprise Linux 7",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:8"
              ],
              "defaultStatus": "unaffected",
              "packageName": "libsoup",
              "product": "Red Hat Enterprise Linux 8",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:9"
              ],
              "defaultStatus": "unaffected",
              "packageName": "libsoup",
              "product": "Red Hat Enterprise Linux 9",
              "vendor": "Red Hat"
            }
          ],
          "credits": [
            {
              "lang": "en",
              "value": "Red Hat would like to thank Naresh Kandula (Nottiboy_1337) for reporting this issue."
            }
          ],
          "datePublic": "2026-09-03T13:00:00.000Z",
          "descriptions": [
            {
              "lang": "en",
              "value": "A flaw was found in libsoup. A malicious HTTP/2 server or a Man-in-the-Middle (MITM) attacker can exploit a heap use-after-free vulnerability in the HTTP/2 client implementation. This occurs when a GNOME application uploads a file using HTTP/2, and the server sends a GOAWAY frame while the file body is being read asynchronously. This can lead to memory corruption, potentially resulting in information disclosure or arbitrary code execution."
            }
          ],
          "metrics": [
            {
              "other": {
                "content": {
                  "namespace": "https://access.redhat.com/security/updates/classification/",
                  "value": "Important"
                },
                "type": "Red Hat severity rating"
              }
            },
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.6,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H",
                "version": "3.1"
              },
              "format": "CVSS"
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-416",
                  "description": "Use After Free",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-04T14:42:53.055Z",
            "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
            "shortName": "redhat"
          },
          "references": [
            {
              "tags": [
                "vdb-entry",
                "x_refsource_REDHAT"
              ],
              "url": "https://access.redhat.com/security/cve/CVE-2026-85197"
            },
            {
              "name": "RHBZ#2528425",
              "tags": [
                "issue-tracking",
                "x_refsource_REDHAT"
              ],
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528425"
            },
            {
              "url": "https://gitlab.gnome.org/GNOME/libsoup/-/work_items/552"
            }
          ],
          "timeline": [
            {
              "lang": "en",
              "time": "2026-09-04T07:12:40.870Z",
              "value": "Reported to Red Hat."
            },
            {
              "lang": "en",
              "time": "2026-09-03T13:00:00.000Z",
              "value": "Made public."
            }
          ],
          "title": "Libsoup: libsoup: heap use-after-free in libsoup http/2 client on_data_read() via goaway during body upload",
          "workarounds": [
            {
              "lang": "en",
              "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
            }
          ],
          "x_generator": {
            "engine": "cvelib 1.8.0"
          },
          "x_redhatCweChain": "CWE-416: Use After Free"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "assignerShortName": "redhat",
        "cveId": "CVE-2026-85197",
        "datePublished": "2026-09-04T07:34:31.869Z",
        "dateReserved": "2026-09-03T12:45:28.161Z",
        "dateUpdated": "2026-09-04T18:15:28.916Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-84185 (GCVE-0-2026-84185)

    Vulnerability from nvd – Published: 2026-09-03 20:46 – Updated: 2026-09-04 18:57
    VLAI
    Title
    Jwcrypto: jwcrypto: general json jws kid binding bypass during jwkset verification
    Summary
    A flaw was found in the jwcrypto library, which is used for implementing Javascript Object Signing and Encryption (JOSE) standards. The issue occurs when the library verifies a General JSON Serialization JWS using a set of keys. Due to a coding error, the library fails to correctly identify the specific key ID (kid) and may instead accept a signature made by any valid key in the set. This can allow an attacker with a valid key to bypass authorization checks in applications that rely on the key ID to identify specific tenants or users.
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-04 18:52 UTC
    CWE
    • CWE-347 - Improper Verification of Cryptographic Signature
    References
    URL Tags
    https://access.redhat.com/security/cve/CVE-2026-84185 vdb-entryx_refsource_REDHAT
    https://bugzilla.redhat.com/show_bug.cgi?id=2526729 issue-trackingx_refsource_REDHAT
    Date Public
    2026-09-03 20:32
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-84185",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-04T18:52:38.110542Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-04T18:57:22.299Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:ansible_automation_platform:2"
              ],
              "defaultStatus": "affected",
              "packageName": "ansible-automation-platform-24/controller-rhel8",
              "product": "Red Hat Ansible Automation Platform 2",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:ansible_automation_platform:2"
              ],
              "defaultStatus": "affected",
              "packageName": "ansible-automation-platform-24/lightspeed-rhel8",
              "product": "Red Hat Ansible Automation Platform 2",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:ansible_automation_platform:2"
              ],
              "defaultStatus": "affected",
              "packageName": "ansible-automation-platform-25/controller-rhel8",
              "product": "Red Hat Ansible Automation Platform 2",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:ansible_automation_platform:2"
              ],
              "defaultStatus": "affected",
              "packageName": "ansible-automation-platform-25/gateway-rhel8",
              "product": "Red Hat Ansible Automation Platform 2",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:ansible_automation_platform:2"
              ],
              "defaultStatus": "affected",
              "packageName": "ansible-automation-platform-25/lightspeed-rhel8",
              "product": "Red Hat Ansible Automation Platform 2",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:ansible_automation_platform:2"
              ],
              "defaultStatus": "affected",
              "packageName": "ansible-automation-platform-26/controller-rhel9",
              "product": "Red Hat Ansible Automation Platform 2",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:ansible_automation_platform:2"
              ],
              "defaultStatus": "affected",
              "packageName": "ansible-automation-platform-26/gateway-rhel9",
              "product": "Red Hat Ansible Automation Platform 2",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:ansible_automation_platform:2"
              ],
              "defaultStatus": "affected",
              "packageName": "ansible-automation-platform-26/lightspeed-rhel9",
              "product": "Red Hat Ansible Automation Platform 2",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:ansible_automation_platform:2"
              ],
              "defaultStatus": "affected",
              "packageName": "ansible-automation-platform-27/gateway-rhel9",
              "product": "Red Hat Ansible Automation Platform 2",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:ansible_automation_platform:2"
              ],
              "defaultStatus": "affected",
              "packageName": "ansible-automation-platform-27/lightspeed-rhel9",
              "product": "Red Hat Ansible Automation Platform 2",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:ansible_automation_platform:2"
              ],
              "defaultStatus": "affected",
              "packageName": "automation-controller",
              "product": "Red Hat Ansible Automation Platform 2",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:ansible_automation_platform:2"
              ],
              "defaultStatus": "affected",
              "packageName": "python3.11-jwcrypto",
              "product": "Red Hat Ansible Automation Platform 2",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:ansible_automation_platform:2"
              ],
              "defaultStatus": "affected",
              "packageName": "python3.12-jwcrypto",
              "product": "Red Hat Ansible Automation Platform 2",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:10"
              ],
              "defaultStatus": "affected",
              "packageName": "python-jwcrypto",
              "product": "Red Hat Enterprise Linux 10",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:7"
              ],
              "defaultStatus": "affected",
              "packageName": "python-jwcrypto",
              "product": "Red Hat Enterprise Linux 7",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:8"
              ],
              "defaultStatus": "affected",
              "packageName": "idm:client/python-jwcrypto",
              "product": "Red Hat Enterprise Linux 8",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:8"
              ],
              "defaultStatus": "affected",
              "packageName": "idm:DL1/python-jwcrypto",
              "product": "Red Hat Enterprise Linux 8",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:9"
              ],
              "defaultStatus": "affected",
              "packageName": "python-jwcrypto",
              "product": "Red Hat Enterprise Linux 9",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:openshift_ai"
              ],
              "defaultStatus": "unaffected",
              "packageName": "rhoai/odh-feature-server-rhel9",
              "product": "Red Hat OpenShift AI (RHOAI)",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:openshift_ai"
              ],
              "defaultStatus": "unaffected",
              "packageName": "rhoai/odh-kserve-storage-initializer-rhel9",
              "product": "Red Hat OpenShift AI (RHOAI)",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:openstack:16.2"
              ],
              "defaultStatus": "unaffected",
              "packageName": "rhosp-rhel8/openstack-mistral-executor",
              "product": "Red Hat OpenStack Platform 16.2",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:openstack:16.2"
              ],
              "defaultStatus": "unaffected",
              "packageName": "rhosp-rhel8/openstack-nova-api",
              "product": "Red Hat OpenStack Platform 16.2",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:openstack:16.2"
              ],
              "defaultStatus": "unaffected",
              "packageName": "rhosp-rhel8/openstack-nova-compute-ironic",
              "product": "Red Hat OpenStack Platform 16.2",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:openstack:16.2"
              ],
              "defaultStatus": "unaffected",
              "packageName": "rhosp-rhel8/openstack-novajoin-base",
              "product": "Red Hat OpenStack Platform 16.2",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:openstack:16.2"
              ],
              "defaultStatus": "unaffected",
              "packageName": "rhosp-rhel8/openstack-novajoin-notifier",
              "product": "Red Hat OpenStack Platform 16.2",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:openstack:16.2"
              ],
              "defaultStatus": "unaffected",
              "packageName": "rhosp-rhel8/openstack-novajoin-server",
              "product": "Red Hat OpenStack Platform 16.2",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:openstack:16.2"
              ],
              "defaultStatus": "unaffected",
              "packageName": "rhosp-rhel8/openstack-tempest",
              "product": "Red Hat OpenStack Platform 16.2",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:openstack:16.2"
              ],
              "defaultStatus": "unaffected",
              "packageName": "rhosp-rhel8/openstack-tripleoclient",
              "product": "Red Hat OpenStack Platform 16.2",
              "vendor": "Red Hat"
            }
          ],
          "datePublic": "2026-09-03T20:32:00.000Z",
          "descriptions": [
            {
              "lang": "en",
              "value": "A flaw was found in the jwcrypto library, which is used for implementing Javascript Object Signing and Encryption (JOSE) standards. The issue occurs when the library verifies a General JSON Serialization JWS using a set of keys. Due to a coding error, the library fails to correctly identify the specific key ID (kid) and may instead accept a signature made by any valid key in the set. This can allow an attacker with a valid key to bypass authorization checks in applications that rely on the key ID to identify specific tenants or users."
            }
          ],
          "metrics": [
            {
              "other": {
                "content": {
                  "namespace": "https://access.redhat.com/security/updates/classification/",
                  "value": "Moderate"
                },
                "type": "Red Hat severity rating"
              }
            },
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 5.9,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N",
                "version": "3.1"
              },
              "format": "CVSS"
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-347",
                  "description": "Improper Verification of Cryptographic Signature",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-03T20:46:40.788Z",
            "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
            "shortName": "redhat"
          },
          "references": [
            {
              "tags": [
                "vdb-entry",
                "x_refsource_REDHAT"
              ],
              "url": "https://access.redhat.com/security/cve/CVE-2026-84185"
            },
            {
              "name": "RHBZ#2526729",
              "tags": [
                "issue-tracking",
                "x_refsource_REDHAT"
              ],
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2526729"
            }
          ],
          "timeline": [
            {
              "lang": "en",
              "time": "2026-09-01T10:22:42.646Z",
              "value": "Reported to Red Hat."
            },
            {
              "lang": "en",
              "time": "2026-09-03T20:32:00.000Z",
              "value": "Made public."
            }
          ],
          "title": "Jwcrypto: jwcrypto: general json jws kid binding bypass during jwkset verification",
          "workarounds": [
            {
              "lang": "en",
              "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
            }
          ],
          "x_generator": {
            "engine": "cvelib 1.8.0"
          },
          "x_redhatCweChain": "CWE-347: Improper Verification of Cryptographic Signature"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "assignerShortName": "redhat",
        "cveId": "CVE-2026-84185",
        "datePublished": "2026-09-03T20:46:40.788Z",
        "dateReserved": "2026-09-01T10:24:25.710Z",
        "dateUpdated": "2026-09-04T18:57:22.299Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-85150 (GCVE-0-2026-85150)

    Vulnerability from nvd – Published: 2026-09-03 10:47 – Updated: 2026-09-03 12:34
    VLAI
    Title
    Gstreamer1-plugins-base: gstreamer: null/invalid-pointer dereference in gst_rtsp_message_parse_auth_credentials() when parsing a crafted digest authorization/www-authenticate header
    Summary
    A NULL pointer dereference flaw was found in GStreamer's RTSP support library. The vulnerability occurs while parsing an Authorization or WWW-Authenticate header that uses Digest authentication. Specially crafted whitespace placement around a parameter's terminator can cause an internal length calculation to underflow, leading to a crash of the process parsing the header. On an RTSP server this can be triggered by a remote, unauthenticated attacker sending a single malformed request when the server has authentication enabled; the same flaw can also be triggered against an RTSP client by a malicious or compromised RTSP server. Successful exploitation results in a denial of service (application crash) and has no confirmed impact on confidentiality or integrity.
    SSVC
    Exploitation: none Automatable: yes Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-03 12:33 UTC
    CWE
    • CWE-476 - NULL Pointer Dereference
    Impacted products
    Date Public
    2026-09-03 10:25
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-85150",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-03T12:33:40.281754Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-03T12:34:05.679Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:10"
              ],
              "defaultStatus": "affected",
              "packageName": "gstreamer1-plugins-base",
              "product": "Red Hat Enterprise Linux 10",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:7"
              ],
              "defaultStatus": "affected",
              "packageName": "gstreamer1-plugins-base",
              "product": "Red Hat Enterprise Linux 7",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:8"
              ],
              "defaultStatus": "affected",
              "packageName": "gstreamer1-plugins-base",
              "product": "Red Hat Enterprise Linux 8",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:9"
              ],
              "defaultStatus": "affected",
              "packageName": "gstreamer1-plugins-base",
              "product": "Red Hat Enterprise Linux 9",
              "vendor": "Red Hat"
            }
          ],
          "credits": [
            {
              "lang": "en",
              "value": "Upstream acknowledges Roy Lau (Independent researcher) as the original reporter."
            }
          ],
          "datePublic": "2026-09-03T10:25:00.000Z",
          "descriptions": [
            {
              "lang": "en",
              "value": "A NULL pointer dereference flaw was found in GStreamer\u0027s RTSP support library. The vulnerability occurs while parsing an Authorization or WWW-Authenticate header that uses Digest authentication. Specially crafted whitespace placement around a parameter\u0027s terminator can cause an internal length calculation to underflow, leading to a crash of the process parsing the header. On an RTSP server this can be triggered by a remote, unauthenticated attacker sending a single malformed request when the server has authentication enabled; the same flaw can also be triggered against an RTSP client by a malicious or compromised RTSP server. Successful exploitation results in a denial of service (application crash) and has no confirmed impact on confidentiality or integrity."
            }
          ],
          "metrics": [
            {
              "other": {
                "content": {
                  "namespace": "https://access.redhat.com/security/updates/classification/",
                  "value": "Moderate"
                },
                "type": "Red Hat severity rating"
              }
            },
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "format": "CVSS"
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-476",
                  "description": "NULL Pointer Dereference",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-03T10:47:10.711Z",
            "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
            "shortName": "redhat"
          },
          "references": [
            {
              "tags": [
                "vdb-entry",
                "x_refsource_REDHAT"
              ],
              "url": "https://access.redhat.com/security/cve/CVE-2026-85150"
            },
            {
              "name": "RHBZ#2527936",
              "tags": [
                "issue-tracking",
                "x_refsource_REDHAT"
              ],
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2527936"
            },
            {
              "url": "https://gitlab.freedesktop.org/gstreamer/gstreamer-security/-/merge_requests/120"
            },
            {
              "url": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/blob/main/subprojects/gst-plugins-base/gst-libs/gst/rtsp/gstrtspmessage.c#L1408"
            }
          ],
          "timeline": [
            {
              "lang": "en",
              "time": "2026-08-26T00:00:00.000Z",
              "value": "Reported to Red Hat."
            },
            {
              "lang": "en",
              "time": "2026-09-03T10:25:00.000Z",
              "value": "Made public."
            }
          ],
          "title": "Gstreamer1-plugins-base: gstreamer: null/invalid-pointer dereference in gst_rtsp_message_parse_auth_credentials() when parsing a crafted digest authorization/www-authenticate header",
          "workarounds": [
            {
              "lang": "en",
              "value": "No mitigation is currently available that meets Red Hat Product Security\u0027s standards for usability, deployment, applicability, or stability."
            }
          ],
          "x_generator": {
            "engine": "cvelib 1.8.0"
          },
          "x_redhatCweChain": "CWE-476: NULL Pointer Dereference"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "assignerShortName": "redhat",
        "cveId": "CVE-2026-85150",
        "datePublished": "2026-09-03T10:47:10.711Z",
        "dateReserved": "2026-09-03T10:21:17.760Z",
        "dateUpdated": "2026-09-03T12:34:05.679Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-71224 (GCVE-0-2026-71224)

    Vulnerability from nvd – Published: 2026-09-03 12:23 – Updated: 2026-09-03 12:58
    VLAI
    Title
    Gfs2-utils: gfs2-utils: stack overflow via alloca(i_height) in metadata walk
    Summary
    A stack overflow vulnerability was found in gfs2-utils. The metadata walk code in metawalk.c uses alloca() with an untrusted inode height value from on-disk metadata without bounds validation, causing stack exhaustion and a denial of service when processing crafted GFS2 filesystem images.
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-03 12:57 UTC
    CWE
    • CWE-770 - Allocation of Resources Without Limits or Throttling
    References
    URL Tags
    https://access.redhat.com/security/cve/CVE-2026-71224 vdb-entryx_refsource_REDHAT
    https://bugzilla.redhat.com/show_bug.cgi?id=2511397 issue-trackingx_refsource_REDHAT
    Impacted products
    Vendor Product Version
    Red Hat Red Hat Enterprise Linux 7     cpe:/o:redhat:enterprise_linux:7
    Create a notification for this product.
    Red Hat Red Hat Enterprise Linux 8     cpe:/o:redhat:enterprise_linux:8
    Create a notification for this product.
    Red Hat Red Hat Enterprise Linux 9     cpe:/o:redhat:enterprise_linux:9
    Create a notification for this product.
    Date Public
    2026-09-03 11:50
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-71224",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-03T12:57:29.852983Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-03T12:58:06.407Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:7"
              ],
              "defaultStatus": "affected",
              "packageName": "gfs2-utils",
              "product": "Red Hat Enterprise Linux 7",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:8"
              ],
              "defaultStatus": "affected",
              "packageName": "gfs2-utils",
              "product": "Red Hat Enterprise Linux 8",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:9"
              ],
              "defaultStatus": "affected",
              "packageName": "gfs2-utils",
              "product": "Red Hat Enterprise Linux 9",
              "vendor": "Red Hat"
            }
          ],
          "credits": [
            {
              "lang": "en",
              "value": "Red Hat would like to thank Tristan Madani (Talence Security) for reporting this issue."
            }
          ],
          "datePublic": "2026-09-03T11:50:05.898Z",
          "descriptions": [
            {
              "lang": "en",
              "value": "A stack overflow vulnerability was found in gfs2-utils. The metadata walk code in metawalk.c uses alloca() with an untrusted inode height value from on-disk metadata without bounds validation, causing stack exhaustion and a denial of service when processing crafted GFS2 filesystem images."
            }
          ],
          "metrics": [
            {
              "other": {
                "content": {
                  "namespace": "https://access.redhat.com/security/updates/classification/",
                  "value": "Moderate"
                },
                "type": "Red Hat severity rating"
              }
            },
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 4.7,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "format": "CVSS"
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-770",
                  "description": "Allocation of Resources Without Limits or Throttling",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-03T12:23:31.604Z",
            "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
            "shortName": "redhat"
          },
          "references": [
            {
              "tags": [
                "vdb-entry",
                "x_refsource_REDHAT"
              ],
              "url": "https://access.redhat.com/security/cve/CVE-2026-71224"
            },
            {
              "name": "RHBZ#2511397",
              "tags": [
                "issue-tracking",
                "x_refsource_REDHAT"
              ],
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511397"
            }
          ],
          "timeline": [
            {
              "lang": "en",
              "time": "2026-06-10T00:00:00.000Z",
              "value": "Reported to Red Hat."
            },
            {
              "lang": "en",
              "time": "2026-09-03T11:50:05.898Z",
              "value": "Made public."
            }
          ],
          "title": "Gfs2-utils: gfs2-utils: stack overflow via alloca(i_height) in metadata walk",
          "workarounds": [
            {
              "lang": "en",
              "value": "Run gfs2-utils tools in a containerized or VM-isolated environment when processing potentially compromised or untrusted GFS2 filesystem images. Disable automatic fsck at boot for GFS2 filesystems until patches are applied by setting fs_passno to 0 in /etc/fstab. Use ulimit -s to reduce the stack size limit, converting potential exploitation into a controlled crash."
            }
          ],
          "x_generator": {
            "engine": "cvelib 1.8.0"
          },
          "x_redhatCweChain": "CWE-770: Allocation of Resources Without Limits or Throttling"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "assignerShortName": "redhat",
        "cveId": "CVE-2026-71224",
        "datePublished": "2026-09-03T12:23:31.604Z",
        "dateReserved": "2026-08-05T08:51:19.853Z",
        "dateUpdated": "2026-09-03T12:58:06.407Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-71222 (GCVE-0-2026-71222)

    Vulnerability from nvd – Published: 2026-09-03 12:23 – Updated: 2026-09-05 01:20
    VLAI
    Title
    Gfs2-utils: gfs2-utils: heap out-of-bounds read via unchecked ea_num_ptrs in extended attribute processing
    Summary
    A heap out-of-bounds read vulnerability was found in gfs2-utils. The ea_num_ptrs field from on-disk extended attribute metadata is consumed without bounds validation, causing a heap buffer over-read that may disclose sensitive memory contents or cause a crash when processing crafted GFS2 filesystem images.
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-05 01:20 UTC
    CWE
    References
    URL Tags
    https://access.redhat.com/security/cve/CVE-2026-71222 vdb-entryx_refsource_REDHAT
    https://bugzilla.redhat.com/show_bug.cgi?id=2511399 issue-trackingx_refsource_REDHAT
    Impacted products
    Vendor Product Version
    Red Hat Red Hat Enterprise Linux 7     cpe:/o:redhat:enterprise_linux:7
    Create a notification for this product.
    Red Hat Red Hat Enterprise Linux 8     cpe:/o:redhat:enterprise_linux:8
    Create a notification for this product.
    Red Hat Red Hat Enterprise Linux 9     cpe:/o:redhat:enterprise_linux:9
    Create a notification for this product.
    Date Public
    2026-09-03 11:49
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-71222",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-05T01:20:41.071089Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-05T01:20:51.104Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:7"
              ],
              "defaultStatus": "affected",
              "packageName": "gfs2-utils",
              "product": "Red Hat Enterprise Linux 7",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:8"
              ],
              "defaultStatus": "affected",
              "packageName": "gfs2-utils",
              "product": "Red Hat Enterprise Linux 8",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:9"
              ],
              "defaultStatus": "affected",
              "packageName": "gfs2-utils",
              "product": "Red Hat Enterprise Linux 9",
              "vendor": "Red Hat"
            }
          ],
          "credits": [
            {
              "lang": "en",
              "value": "Red Hat would like to thank Tristan Madani (Talence Security) for reporting this issue."
            }
          ],
          "datePublic": "2026-09-03T11:49:24.668Z",
          "descriptions": [
            {
              "lang": "en",
              "value": "A heap out-of-bounds read vulnerability was found in gfs2-utils. The ea_num_ptrs field from on-disk extended attribute metadata is consumed without bounds validation, causing a heap buffer over-read that may disclose sensitive memory contents or cause a crash when processing crafted GFS2 filesystem images."
            }
          ],
          "metrics": [
            {
              "other": {
                "content": {
                  "namespace": "https://access.redhat.com/security/updates/classification/",
                  "value": "Moderate"
                },
                "type": "Red Hat severity rating"
              }
            },
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "LOCAL",
                "availabilityImpact": "LOW",
                "baseScore": 5.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:L",
                "version": "3.1"
              },
              "format": "CVSS"
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-125",
                  "description": "Out-of-bounds Read",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-03T12:23:22.616Z",
            "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
            "shortName": "redhat"
          },
          "references": [
            {
              "tags": [
                "vdb-entry",
                "x_refsource_REDHAT"
              ],
              "url": "https://access.redhat.com/security/cve/CVE-2026-71222"
            },
            {
              "name": "RHBZ#2511399",
              "tags": [
                "issue-tracking",
                "x_refsource_REDHAT"
              ],
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511399"
            }
          ],
          "timeline": [
            {
              "lang": "en",
              "time": "2026-06-10T00:00:00.000Z",
              "value": "Reported to Red Hat."
            },
            {
              "lang": "en",
              "time": "2026-09-03T11:49:24.668Z",
              "value": "Made public."
            }
          ],
          "title": "Gfs2-utils: gfs2-utils: heap out-of-bounds read via unchecked ea_num_ptrs in extended attribute processing",
          "workarounds": [
            {
              "lang": "en",
              "value": "Do not process untrusted GFS2 filesystem images with gfs2-utils tools. Run gfs2-utils tools in a containerized or VM-isolated environment when processing untrusted images."
            }
          ],
          "x_generator": {
            "engine": "cvelib 1.8.0"
          },
          "x_redhatCweChain": "CWE-125: Out-of-bounds Read"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "assignerShortName": "redhat",
        "cveId": "CVE-2026-71222",
        "datePublished": "2026-09-03T12:23:22.616Z",
        "dateReserved": "2026-08-05T08:51:19.853Z",
        "dateUpdated": "2026-09-05T01:20:51.104Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-71221 (GCVE-0-2026-71221)

    Vulnerability from nvd – Published: 2026-09-03 12:23 – Updated: 2026-09-03 14:52
    VLAI
    Title
    Gfs2-utils: gfs2-utils: stack out-of-bounds write via unchecked height in savemeta
    Summary
    A stack out-of-bounds write vulnerability was found in gfs2-utils. In savemeta, the height value from on-disk inode metadata is used as a loop bound without bounds checking, causing a stack buffer overflow that may lead to arbitrary code execution when processing crafted GFS2 filesystem images.
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-03 14:07 UTC
    CWE
    References
    URL Tags
    https://access.redhat.com/security/cve/CVE-2026-71221 vdb-entryx_refsource_REDHAT
    https://bugzilla.redhat.com/show_bug.cgi?id=2511396 issue-trackingx_refsource_REDHAT
    Impacted products
    Vendor Product Version
    Red Hat Red Hat Enterprise Linux 7     cpe:/o:redhat:enterprise_linux:7
    Create a notification for this product.
    Red Hat Red Hat Enterprise Linux 8     cpe:/o:redhat:enterprise_linux:8
    Create a notification for this product.
    Red Hat Red Hat Enterprise Linux 9     cpe:/o:redhat:enterprise_linux:9
    Create a notification for this product.
    Date Public
    2026-09-03 11:45
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-71221",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-03T14:07:56.982491Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-03T14:30:00.002Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:7"
              ],
              "defaultStatus": "affected",
              "packageName": "gfs2-utils",
              "product": "Red Hat Enterprise Linux 7",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:8"
              ],
              "defaultStatus": "affected",
              "packageName": "gfs2-utils",
              "product": "Red Hat Enterprise Linux 8",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:9"
              ],
              "defaultStatus": "affected",
              "packageName": "gfs2-utils",
              "product": "Red Hat Enterprise Linux 9",
              "vendor": "Red Hat"
            }
          ],
          "credits": [
            {
              "lang": "en",
              "value": "Red Hat would like to thank Tristan Madani (Talence Security) for reporting this issue."
            }
          ],
          "datePublic": "2026-09-03T11:45:05.700Z",
          "descriptions": [
            {
              "lang": "en",
              "value": "A stack out-of-bounds write vulnerability was found in gfs2-utils. In savemeta, the height value from on-disk inode metadata is used as a loop bound without bounds checking, causing a stack buffer overflow that may lead to arbitrary code execution when processing crafted GFS2 filesystem images."
            }
          ],
          "metrics": [
            {
              "other": {
                "content": {
                  "namespace": "https://access.redhat.com/security/updates/classification/",
                  "value": "Moderate"
                },
                "type": "Red Hat severity rating"
              }
            },
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "format": "CVSS"
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-787",
                  "description": "Out-of-bounds Write",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-03T14:52:36.340Z",
            "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
            "shortName": "redhat"
          },
          "references": [
            {
              "tags": [
                "vdb-entry",
                "x_refsource_REDHAT"
              ],
              "url": "https://access.redhat.com/security/cve/CVE-2026-71221"
            },
            {
              "name": "RHBZ#2511396",
              "tags": [
                "issue-tracking",
                "x_refsource_REDHAT"
              ],
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511396"
            }
          ],
          "timeline": [
            {
              "lang": "en",
              "time": "2026-06-10T00:00:00.000Z",
              "value": "Reported to Red Hat."
            },
            {
              "lang": "en",
              "time": "2026-09-03T11:45:05.700Z",
              "value": "Made public."
            }
          ],
          "title": "Gfs2-utils: gfs2-utils: stack out-of-bounds write via unchecked height in savemeta",
          "workarounds": [
            {
              "lang": "en",
              "value": "Do not run gfs2-utils savemeta on untrusted or potentially compromised GFS2 filesystem images. Run gfs2-utils tools in a containerized or VM-isolated environment when processing untrusted images. Disable automatic fsck at boot for GFS2 filesystems until patches are applied by setting fs_passno to 0 in /etc/fstab."
            }
          ],
          "x_generator": {
            "engine": "cvelib 1.8.0"
          },
          "x_redhatCweChain": "CWE-787: Out-of-bounds Write"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "assignerShortName": "redhat",
        "cveId": "CVE-2026-71221",
        "datePublished": "2026-09-03T12:23:17.596Z",
        "dateReserved": "2026-08-05T08:51:19.853Z",
        "dateUpdated": "2026-09-03T14:52:36.340Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-71220 (GCVE-0-2026-71220)

    Vulnerability from nvd – Published: 2026-09-03 12:23 – Updated: 2026-09-03 14:52
    VLAI
    Title
    Gfs2-utils: gfs2-utils: stack out-of-bounds write via unchecked di_height in gfs2_edit
    Summary
    A stack out-of-bounds write vulnerability was found in gfs2-utils. In gfs2_edit, the di_height field from on-disk inode metadata is used as an array index without bounds checking, causing a stack buffer overflow that may lead to arbitrary code execution when processing crafted GFS2 filesystem images.
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-03 12:52 UTC
    CWE
    References
    URL Tags
    https://access.redhat.com/security/cve/CVE-2026-71220 vdb-entryx_refsource_REDHAT
    https://bugzilla.redhat.com/show_bug.cgi?id=2511398 issue-trackingx_refsource_REDHAT
    Impacted products
    Vendor Product Version
    Red Hat Red Hat Enterprise Linux 7     cpe:/o:redhat:enterprise_linux:7
    Create a notification for this product.
    Red Hat Red Hat Enterprise Linux 8     cpe:/o:redhat:enterprise_linux:8
    Create a notification for this product.
    Red Hat Red Hat Enterprise Linux 9     cpe:/o:redhat:enterprise_linux:9
    Create a notification for this product.
    Date Public
    2026-09-03 11:43
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-71220",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-03T12:52:57.593511Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-03T12:53:18.501Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:7"
              ],
              "defaultStatus": "affected",
              "packageName": "gfs2-utils",
              "product": "Red Hat Enterprise Linux 7",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:8"
              ],
              "defaultStatus": "affected",
              "packageName": "gfs2-utils",
              "product": "Red Hat Enterprise Linux 8",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:9"
              ],
              "defaultStatus": "affected",
              "packageName": "gfs2-utils",
              "product": "Red Hat Enterprise Linux 9",
              "vendor": "Red Hat"
            }
          ],
          "credits": [
            {
              "lang": "en",
              "value": "Red Hat would like to thank Tristan Madani (Talence Security) for reporting this issue."
            }
          ],
          "datePublic": "2026-09-03T11:43:38.063Z",
          "descriptions": [
            {
              "lang": "en",
              "value": "A stack out-of-bounds write vulnerability was found in gfs2-utils. In gfs2_edit, the di_height field from on-disk inode metadata is used as an array index without bounds checking, causing a stack buffer overflow that may lead to arbitrary code execution when processing crafted GFS2 filesystem images."
            }
          ],
          "metrics": [
            {
              "other": {
                "content": {
                  "namespace": "https://access.redhat.com/security/updates/classification/",
                  "value": "Moderate"
                },
                "type": "Red Hat severity rating"
              }
            },
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "format": "CVSS"
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-787",
                  "description": "Out-of-bounds Write",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-03T14:52:32.098Z",
            "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
            "shortName": "redhat"
          },
          "references": [
            {
              "tags": [
                "vdb-entry",
                "x_refsource_REDHAT"
              ],
              "url": "https://access.redhat.com/security/cve/CVE-2026-71220"
            },
            {
              "name": "RHBZ#2511398",
              "tags": [
                "issue-tracking",
                "x_refsource_REDHAT"
              ],
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511398"
            }
          ],
          "timeline": [
            {
              "lang": "en",
              "time": "2026-06-10T00:00:00.000Z",
              "value": "Reported to Red Hat."
            },
            {
              "lang": "en",
              "time": "2026-09-03T11:43:38.063Z",
              "value": "Made public."
            }
          ],
          "title": "Gfs2-utils: gfs2-utils: stack out-of-bounds write via unchecked di_height in gfs2_edit",
          "workarounds": [
            {
              "lang": "en",
              "value": "Do not run gfs2_edit on untrusted or potentially compromised GFS2 filesystem images. Run gfs2-utils tools in a containerized or VM-isolated environment when processing untrusted images. Disable automatic fsck at boot for GFS2 filesystems until patches are applied by setting fs_passno to 0 in /etc/fstab."
            }
          ],
          "x_generator": {
            "engine": "cvelib 1.8.0"
          },
          "x_redhatCweChain": "CWE-787: Out-of-bounds Write"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "assignerShortName": "redhat",
        "cveId": "CVE-2026-71220",
        "datePublished": "2026-09-03T12:23:12.906Z",
        "dateReserved": "2026-08-05T08:51:19.852Z",
        "dateUpdated": "2026-09-03T14:52:32.098Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-71219 (GCVE-0-2026-71219)

    Vulnerability from nvd – Published: 2026-09-03 12:23 – Updated: 2026-09-04 18:41
    VLAI
    Title
    Gfs2-utils: gfs2-utils: stack overflow via alloca(1<<di_depth) in hash table traversal
    Summary
    A stack overflow vulnerability was found in gfs2-utils. The hash table traversal code in metawalk.c uses alloca() with an exponentially-derived size from the untrusted on-disk di_depth field without bounds validation. A crafted GFS2 filesystem image with a large di_depth value causes stack exhaustion and a denial of service when processed by fsck.gfs2, gfs2_edit, or savemeta.
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-04 18:41 UTC
    CWE
    • CWE-770 - Allocation of Resources Without Limits or Throttling
    References
    URL Tags
    https://access.redhat.com/security/cve/CVE-2026-71219 vdb-entryx_refsource_REDHAT
    https://bugzilla.redhat.com/show_bug.cgi?id=2507750 issue-trackingx_refsource_REDHAT
    Impacted products
    Vendor Product Version
    Red Hat Red Hat Enterprise Linux 7     cpe:/o:redhat:enterprise_linux:7
    Create a notification for this product.
    Red Hat Red Hat Enterprise Linux 8     cpe:/o:redhat:enterprise_linux:8
    Create a notification for this product.
    Red Hat Red Hat Enterprise Linux 9     cpe:/o:redhat:enterprise_linux:9
    Create a notification for this product.
    Date Public
    2026-09-03 11:40
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-71219",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-04T18:41:29.343480Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-04T18:41:38.906Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:7"
              ],
              "defaultStatus": "affected",
              "packageName": "gfs2-utils",
              "product": "Red Hat Enterprise Linux 7",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:8"
              ],
              "defaultStatus": "affected",
              "packageName": "gfs2-utils",
              "product": "Red Hat Enterprise Linux 8",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:9"
              ],
              "defaultStatus": "affected",
              "packageName": "gfs2-utils",
              "product": "Red Hat Enterprise Linux 9",
              "vendor": "Red Hat"
            }
          ],
          "credits": [
            {
              "lang": "en",
              "value": "Red Hat would like to thank Tristan Madani (Talence Security) for reporting this issue."
            }
          ],
          "datePublic": "2026-09-03T11:40:42.944Z",
          "descriptions": [
            {
              "lang": "en",
              "value": "A stack overflow vulnerability was found in gfs2-utils. The hash table traversal code in metawalk.c uses alloca() with an exponentially-derived size from the untrusted on-disk di_depth field without bounds validation. A crafted GFS2 filesystem image with a large di_depth value causes stack exhaustion and a denial of service when processed by fsck.gfs2, gfs2_edit, or savemeta."
            }
          ],
          "metrics": [
            {
              "other": {
                "content": {
                  "namespace": "https://access.redhat.com/security/updates/classification/",
                  "value": "Moderate"
                },
                "type": "Red Hat severity rating"
              }
            },
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 4.7,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "format": "CVSS"
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-770",
                  "description": "Allocation of Resources Without Limits or Throttling",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-03T12:23:06.486Z",
            "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
            "shortName": "redhat"
          },
          "references": [
            {
              "tags": [
                "vdb-entry",
                "x_refsource_REDHAT"
              ],
              "url": "https://access.redhat.com/security/cve/CVE-2026-71219"
            },
            {
              "name": "RHBZ#2507750",
              "tags": [
                "issue-tracking",
                "x_refsource_REDHAT"
              ],
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507750"
            }
          ],
          "timeline": [
            {
              "lang": "en",
              "time": "2026-06-10T00:00:00.000Z",
              "value": "Reported to Red Hat."
            },
            {
              "lang": "en",
              "time": "2026-09-03T11:40:42.944Z",
              "value": "Made public."
            }
          ],
          "title": "Gfs2-utils: gfs2-utils: stack overflow via alloca(1\u003c\u003cdi_depth) in hash table traversal",
          "workarounds": [
            {
              "lang": "en",
              "value": "Run gfs2-utils tools in a containerized or VM-isolated environment when processing potentially compromised or untrusted GFS2 filesystem images. Disable automatic fsck at boot for GFS2 filesystems until patches are applied by setting fs_passno to 0 in /etc/fstab. Use ulimit -s to reduce the stack size limit, converting potential exploitation into a controlled crash."
            }
          ],
          "x_generator": {
            "engine": "cvelib 1.8.0"
          },
          "x_redhatCweChain": "CWE-770: Allocation of Resources Without Limits or Throttling"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "assignerShortName": "redhat",
        "cveId": "CVE-2026-71219",
        "datePublished": "2026-09-03T12:23:06.486Z",
        "dateReserved": "2026-08-05T08:51:19.852Z",
        "dateUpdated": "2026-09-04T18:41:38.906Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-66786 (GCVE-0-2026-66786)

    Vulnerability from nvd – Published: 2026-09-02 17:57 – Updated: 2026-09-05 01:01
    VLAI
    Title
    Submariner: submariner: ipsec.conf stanza injection via remote-supplied cablename and subnets
    Summary
    A flaw was found in submariner. In cert-auth mode, the connection configuration is built using free-form strings from the Custom Resource Definition (CRD) without proper validation. A malicious cluster can exploit this by publishing a CableName that includes newlines and ipsec.conf directives. This allows an attacker to inject arbitrary configuration parameters or execute commands through leftupdown hooks, leading to remote code execution as root on the gateway node.
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-05 01:01 UTC
    CWE
    • CWE-94 - Improper Control of Generation of Code ('Code Injection')
    References
    URL Tags
    https://access.redhat.com/errata/RHSA-2026:63016 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/security/cve/CVE-2026-66786 vdb-entryx_refsource_REDHAT
    https://bugzilla.redhat.com/show_bug.cgi?id=2507531 issue-trackingx_refsource_REDHAT
    Impacted products
    Vendor Product Version
    Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.17 Unaffected: 1788023916 , < * (rpm)
        cpe:/a:redhat:acm:2.17::el9
    Create a notification for this product.
    Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.17 Unaffected: 1788023940 , < * (rpm)
        cpe:/a:redhat:acm:2.17::el9
    Create a notification for this product.
    Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.17 Unaffected: 1788105072 , < * (rpm)
        cpe:/a:redhat:acm:2.17::el9
    Create a notification for this product.
    Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.17 Unaffected: 1788043964 , < * (rpm)
        cpe:/a:redhat:acm:2.17::el9
    Create a notification for this product.
    Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.17 Unaffected: 1788043961 , < * (rpm)
        cpe:/a:redhat:acm:2.17::el9
    Create a notification for this product.
    Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.17 Unaffected: 1788073481 , < * (rpm)
        cpe:/a:redhat:acm:2.17::el9
    Create a notification for this product.
    Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.17 Unaffected: 1788043970 , < * (rpm)
        cpe:/a:redhat:acm:2.17::el9
    Create a notification for this product.
    Red Hat Red Hat Advanced Cluster Management for Kubernetes 2     cpe:/a:redhat:acm:2
    Create a notification for this product.
    Date Public
    2026-08-21 16:43
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-66786",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-05T01:01:16.851937Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-05T01:01:30.464Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "collectionURL": "https://catalog.redhat.com/software/containers/",
              "cpes": [
                "cpe:/a:redhat:acm:2.17::el9"
              ],
              "defaultStatus": "affected",
              "packageName": "rhacm2/lighthouse-agent-rhel9",
              "product": "Red Hat Advanced Cluster Management for Kubernetes 2.17",
              "vendor": "Red Hat",
              "versions": [
                {
                  "lessThan": "*",
                  "status": "unaffected",
                  "version": "1788023916",
                  "versionType": "rpm"
                }
              ]
            },
            {
              "collectionURL": "https://catalog.redhat.com/software/containers/",
              "cpes": [
                "cpe:/a:redhat:acm:2.17::el9"
              ],
              "defaultStatus": "affected",
              "packageName": "rhacm2/lighthouse-coredns-rhel9",
              "product": "Red Hat Advanced Cluster Management for Kubernetes 2.17",
              "vendor": "Red Hat",
              "versions": [
                {
                  "lessThan": "*",
                  "status": "unaffected",
                  "version": "1788023940",
                  "versionType": "rpm"
                }
              ]
            },
            {
              "collectionURL": "https://catalog.redhat.com/software/containers/",
              "cpes": [
                "cpe:/a:redhat:acm:2.17::el9"
              ],
              "defaultStatus": "affected",
              "packageName": "rhacm2/subctl-rhel9",
              "product": "Red Hat Advanced Cluster Management for Kubernetes 2.17",
              "vendor": "Red Hat",
              "versions": [
                {
                  "lessThan": "*",
                  "status": "unaffected",
                  "version": "1788105072",
                  "versionType": "rpm"
                }
              ]
            },
            {
              "collectionURL": "https://catalog.redhat.com/software/containers/",
              "cpes": [
                "cpe:/a:redhat:acm:2.17::el9"
              ],
              "defaultStatus": "affected",
              "packageName": "rhacm2/submariner-gateway-rhel9",
              "product": "Red Hat Advanced Cluster Management for Kubernetes 2.17",
              "vendor": "Red Hat",
              "versions": [
                {
                  "lessThan": "*",
                  "status": "unaffected",
                  "version": "1788043964",
                  "versionType": "rpm"
                }
              ]
            },
            {
              "collectionURL": "https://catalog.redhat.com/software/containers/",
              "cpes": [
                "cpe:/a:redhat:acm:2.17::el9"
              ],
              "defaultStatus": "affected",
              "packageName": "rhacm2/submariner-globalnet-rhel9",
              "product": "Red Hat Advanced Cluster Management for Kubernetes 2.17",
              "vendor": "Red Hat",
              "versions": [
                {
                  "lessThan": "*",
                  "status": "unaffected",
                  "version": "1788043961",
                  "versionType": "rpm"
                }
              ]
            },
            {
              "collectionURL": "https://catalog.redhat.com/software/containers/",
              "cpes": [
                "cpe:/a:redhat:acm:2.17::el9"
              ],
              "defaultStatus": "affected",
              "packageName": "rhacm2/submariner-rhel9-operator",
              "product": "Red Hat Advanced Cluster Management for Kubernetes 2.17",
              "vendor": "Red Hat",
              "versions": [
                {
                  "lessThan": "*",
                  "status": "unaffected",
                  "version": "1788073481",
                  "versionType": "rpm"
                }
              ]
            },
            {
              "collectionURL": "https://catalog.redhat.com/software/containers/",
              "cpes": [
                "cpe:/a:redhat:acm:2.17::el9"
              ],
              "defaultStatus": "affected",
              "packageName": "rhacm2/submariner-route-agent-rhel9",
              "product": "Red Hat Advanced Cluster Management for Kubernetes 2.17",
              "vendor": "Red Hat",
              "versions": [
                {
                  "lessThan": "*",
                  "status": "unaffected",
                  "version": "1788043970",
                  "versionType": "rpm"
                }
              ]
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:acm:2"
              ],
              "defaultStatus": "affected",
              "packageName": "rhacm2/submariner-addon-rhel9",
              "product": "Red Hat Advanced Cluster Management for Kubernetes 2",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:acm:2"
              ],
              "defaultStatus": "affected",
              "packageName": "rhacm2/submariner-operator-bundle",
              "product": "Red Hat Advanced Cluster Management for Kubernetes 2",
              "vendor": "Red Hat"
            }
          ],
          "datePublic": "2026-08-21T16:43:00.583Z",
          "descriptions": [
            {
              "lang": "en",
              "value": "A flaw was found in submariner. In cert-auth mode, the connection configuration is built using free-form strings from the Custom Resource Definition (CRD) without proper validation. A malicious cluster can exploit this by publishing a CableName that includes newlines and ipsec.conf directives. This allows an attacker to inject arbitrary configuration parameters or execute commands through leftupdown hooks, leading to remote code execution as root on the gateway node."
            }
          ],
          "metrics": [
            {
              "other": {
                "content": {
                  "namespace": "https://access.redhat.com/security/updates/classification/",
                  "value": "Moderate"
                },
                "type": "Red Hat severity rating"
              }
            },
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.1,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "HIGH",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
                "version": "3.1"
              },
              "format": "CVSS"
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-94",
                  "description": "Improper Control of Generation of Code (\u0027Code Injection\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-03T04:41:49.247Z",
            "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
            "shortName": "redhat"
          },
          "references": [
            {
              "name": "RHSA-2026:63016",
              "tags": [
                "vendor-advisory",
                "x_refsource_REDHAT"
              ],
              "url": "https://access.redhat.com/errata/RHSA-2026:63016"
            },
            {
              "tags": [
                "vdb-entry",
                "x_refsource_REDHAT"
              ],
              "url": "https://access.redhat.com/security/cve/CVE-2026-66786"
            },
            {
              "name": "RHBZ#2507531",
              "tags": [
                "issue-tracking",
                "x_refsource_REDHAT"
              ],
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507531"
            }
          ],
          "timeline": [
            {
              "lang": "en",
              "time": "2026-07-27T00:00:00.000Z",
              "value": "Reported to Red Hat."
            },
            {
              "lang": "en",
              "time": "2026-08-21T16:43:00.583Z",
              "value": "Made public."
            }
          ],
          "title": "Submariner: submariner: ipsec.conf stanza injection via remote-supplied cablename and subnets",
          "workarounds": [
            {
              "lang": "en",
              "value": "If Submariner certificate-based IPsec authentication mode is enabled (`IPSecCertAuthMode: true` in the SubmarinerConfig), administrators can mitigate this flaw by switching to the default pre-shared key (PSK) authentication mode. Set `IPSecCertAuthMode: false` (or remove the field to use its default value) in the SubmarinerConfig CR and redeploy the Submariner gateway pods. PSK mode provides equivalent inter-cluster IPsec tunnel encryption and is not affected by this vulnerability. Note that disabling cert-auth mode means Submariner will no longer integrate with OVN IPsec\u0027s certificate infrastructure and will manage its own PSK-based authentication independently."
            }
          ],
          "x_generator": {
            "engine": "cvelib 1.8.0"
          },
          "x_redhatCweChain": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "assignerShortName": "redhat",
        "cveId": "CVE-2026-66786",
        "datePublished": "2026-09-02T17:57:19.436Z",
        "dateReserved": "2026-07-27T17:51:24.885Z",
        "dateUpdated": "2026-09-05T01:01:30.464Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-84838 (GCVE-0-2026-84838)

    Vulnerability from nvd – Published: 2026-09-02 15:13 – Updated: 2026-09-02 16:24
    VLAI
    Title
    Rpm: command injection in rpmuncompress via unescaped filenames passed to popen()
    Summary
    A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs when rpmuncompress processes a specially crafted archive filename containing shell metacharacters, which are not properly escaped before being passed to shell command strings. Successful exploitation requires user interaction, where a user or automated workflow invokes rpmuncompress on the malicious file, leading to high impact on the confidentiality, integrity, and availability of data accessible to the invoking user.
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-02 16:06 UTC
    CWE
    • CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
    References
    URL Tags
    https://access.redhat.com/security/cve/CVE-2026-84838 vdb-entryx_refsource_REDHAT
    https://bugzilla.redhat.com/show_bug.cgi?id=2462222 issue-trackingx_refsource_REDHAT
    Impacted products
    Date Public
    2026-09-02 13:35
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-84838",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-02T16:06:32.308594Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-02T16:07:57.815Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:10"
              ],
              "defaultStatus": "affected",
              "packageName": "rpm",
              "product": "Red Hat Enterprise Linux 10",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:6"
              ],
              "defaultStatus": "unaffected",
              "packageName": "rpm",
              "product": "Red Hat Enterprise Linux 6",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:7"
              ],
              "defaultStatus": "unaffected",
              "packageName": "rpm",
              "product": "Red Hat Enterprise Linux 7",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:8"
              ],
              "defaultStatus": "unaffected",
              "packageName": "rpm",
              "product": "Red Hat Enterprise Linux 8",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:9"
              ],
              "defaultStatus": "unaffected",
              "packageName": "rpm",
              "product": "Red Hat Enterprise Linux 9",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:hummingbird:1"
              ],
              "defaultStatus": "affected",
              "packageName": "rpm",
              "product": "Red Hat Hardened Images",
              "vendor": "Red Hat"
            }
          ],
          "credits": [
            {
              "lang": "en",
              "value": "This issue was discovered by Found by AISLE in partnership with Red Hat."
            }
          ],
          "datePublic": "2026-09-02T13:35:12.202Z",
          "descriptions": [
            {
              "lang": "en",
              "value": "A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs when rpmuncompress processes a specially crafted archive filename containing shell metacharacters, which are not properly escaped before being passed to shell command strings. Successful exploitation requires user interaction, where a user or automated workflow invokes rpmuncompress on the malicious file, leading to high impact on the confidentiality, integrity, and availability of data accessible to the invoking user."
            }
          ],
          "metrics": [
            {
              "other": {
                "content": {
                  "namespace": "https://access.redhat.com/security/updates/classification/",
                  "value": "Moderate"
                },
                "type": "Red Hat severity rating"
              }
            },
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "format": "CVSS"
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-78",
                  "description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-02T16:24:26.541Z",
            "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
            "shortName": "redhat"
          },
          "references": [
            {
              "tags": [
                "vdb-entry",
                "x_refsource_REDHAT"
              ],
              "url": "https://access.redhat.com/security/cve/CVE-2026-84838"
            },
            {
              "name": "RHBZ#2462222",
              "tags": [
                "issue-tracking",
                "x_refsource_REDHAT"
              ],
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2462222"
            }
          ],
          "timeline": [
            {
              "lang": "en",
              "time": "2026-04-26T18:34:40.000Z",
              "value": "Reported to Red Hat."
            },
            {
              "lang": "en",
              "time": "2026-09-02T13:35:12.202Z",
              "value": "Made public."
            }
          ],
          "title": "Rpm: command injection in rpmuncompress via unescaped filenames passed to popen()",
          "workarounds": [
            {
              "lang": "en",
              "value": "To mitigate this issue, avoid processing untrusted archive filenames with `rpmuncompress` or any workflows that invoke `%{__rpmuncompress}`. Before any build or extraction steps, rename source and patch archives to remove any shell metacharacters from their filenames."
            }
          ],
          "x_generator": {
            "engine": "cvelib 1.8.0"
          },
          "x_redhatCweChain": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "assignerShortName": "redhat",
        "cveId": "CVE-2026-84838",
        "datePublished": "2026-09-02T15:13:02.577Z",
        "dateReserved": "2026-09-02T11:56:41.213Z",
        "dateUpdated": "2026-09-02T16:24:26.541Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-76925 (GCVE-0-2026-76925)

    Vulnerability from cvelistv5 – Published: 2026-09-04 21:02 – Updated: 2026-09-04 21:02
    VLAI
    Title
    Flatpak: flatpak: toctou race condition allows symlink redirection
    Summary
    A flaw was found in Flatpak. A Time-of-check to time-of-use (TOCTOU) race condition exists in the `org.freedesktop.Flatpak.SystemHelper` component. This vulnerability occurs because a privileged `chmod` operation executes before the OSTree repository validation within the `Deploy()` function. An attacker can exploit this timing window to redirect symlinks to arbitrary files, potentially leading to unauthorized file manipulation or information disclosure.
    CWE
    • CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition
    References
    URL Tags
    https://access.redhat.com/security/cve/CVE-2026-76925 vdb-entryx_refsource_REDHAT
    https://bugzilla.redhat.com/show_bug.cgi?id=2520099 issue-trackingx_refsource_REDHAT
    Impacted products
    Date Public
    2026-08-19 00:00
    Show details on NVD website

    {
      "containers": {
        "cna": {
          "affected": [
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:10"
              ],
              "defaultStatus": "affected",
              "packageName": "flatpak",
              "product": "Red Hat Enterprise Linux 10",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:7"
              ],
              "defaultStatus": "affected",
              "packageName": "flatpak",
              "product": "Red Hat Enterprise Linux 7",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:8"
              ],
              "defaultStatus": "affected",
              "packageName": "flatpak",
              "product": "Red Hat Enterprise Linux 8",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:9"
              ],
              "defaultStatus": "affected",
              "packageName": "flatpak",
              "product": "Red Hat Enterprise Linux 9",
              "vendor": "Red Hat"
            }
          ],
          "datePublic": "2026-08-19T00:00:00.000Z",
          "descriptions": [
            {
              "lang": "en",
              "value": "A flaw was found in Flatpak. A Time-of-check to time-of-use (TOCTOU) race condition exists in the `org.freedesktop.Flatpak.SystemHelper` component. This vulnerability occurs because a privileged `chmod` operation executes before the OSTree repository validation within the `Deploy()` function. An attacker can exploit this timing window to redirect symlinks to arbitrary files, potentially leading to unauthorized file manipulation or information disclosure."
            }
          ],
          "metrics": [
            {
              "other": {
                "content": {
                  "namespace": "https://access.redhat.com/security/updates/classification/",
                  "value": "Moderate"
                },
                "type": "Red Hat severity rating"
              }
            },
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "LOCAL",
                "availabilityImpact": "LOW",
                "baseScore": 5.8,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "LOW",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L",
                "version": "3.1"
              },
              "format": "CVSS"
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-367",
                  "description": "Time-of-check Time-of-use (TOCTOU) Race Condition",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-04T21:02:00.079Z",
            "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
            "shortName": "redhat"
          },
          "references": [
            {
              "tags": [
                "vdb-entry",
                "x_refsource_REDHAT"
              ],
              "url": "https://access.redhat.com/security/cve/CVE-2026-76925"
            },
            {
              "name": "RHBZ#2520099",
              "tags": [
                "issue-tracking",
                "x_refsource_REDHAT"
              ],
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2520099"
            }
          ],
          "timeline": [
            {
              "lang": "en",
              "time": "2026-08-19T22:56:29.378Z",
              "value": "Reported to Red Hat."
            },
            {
              "lang": "en",
              "time": "2026-08-19T00:00:00.000Z",
              "value": "Made public."
            }
          ],
          "title": "Flatpak: flatpak: toctou race condition allows symlink redirection",
          "x_generator": {
            "engine": "cvelib 1.8.0"
          },
          "x_redhatCweChain": "CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "assignerShortName": "redhat",
        "cveId": "CVE-2026-76925",
        "datePublished": "2026-09-04T21:02:00.079Z",
        "dateReserved": "2026-08-19T22:57:38.204Z",
        "dateUpdated": "2026-09-04T21:02:00.079Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-85769 (GCVE-0-2026-85769)

    Vulnerability from cvelistv5 – Published: 2026-09-04 17:48 – Updated: 2026-09-04 18:51
    VLAI
    Title
    Libtpms: libtpms: heap out-of-bounds read in tpm2 state unmarshalling via unchecked block_skip_read() blocksize
    Summary
    A flaw was found in libtpms, a library that provides software TPM 2.0 emulation. When restoring TPM 2.0 state (for example during a virtual machine's power-on or state/migration restore), a malformed state blob can supply an oversized skip-block length that is not validated against the remaining size of the input buffer. This can drive an internal size counter negative, which bypasses a subsequent bounds check due to an unsafe signed-to-unsigned conversion, causing the parser to read memory outside the bounds of the heap buffer holding the state data. Successful exploitation can crash the process hosting libtpms (such as swtpm), resulting in a denial of service of the emulated TPM device and the virtual machine that depends on it. No data corruption or information disclosure was confirmed.
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-04 18:51 UTC
    CWE
    Impacted products
    Vendor Product Version
    Red Hat Red Hat Enterprise Linux 10     cpe:/o:redhat:enterprise_linux:10
    Create a notification for this product.
    Red Hat Red Hat Enterprise Linux 8     cpe:/o:redhat:enterprise_linux:8
    Create a notification for this product.
    Red Hat Red Hat Enterprise Linux 9     cpe:/o:redhat:enterprise_linux:9
    Create a notification for this product.
    Date Public
    2026-09-04 00:00
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-85769",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-04T18:51:03.667125Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-04T18:51:12.453Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:10"
              ],
              "defaultStatus": "affected",
              "packageName": "libtpms",
              "product": "Red Hat Enterprise Linux 10",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:8"
              ],
              "defaultStatus": "affected",
              "packageName": "virt:rhel/libtpms",
              "product": "Red Hat Enterprise Linux 8",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:9"
              ],
              "defaultStatus": "affected",
              "packageName": "libtpms",
              "product": "Red Hat Enterprise Linux 9",
              "vendor": "Red Hat"
            }
          ],
          "credits": [
            {
              "lang": "en",
              "value": "Red Hat would like to thank Isuka Sanuj (CyberCrew Inc. (\u682a\u5f0f\u4f1a\u793eCyberCrew)) and Leyao (ICT CAS) for reporting this issue."
            }
          ],
          "datePublic": "2026-09-04T00:00:00.000Z",
          "descriptions": [
            {
              "lang": "en",
              "value": "A flaw was found in libtpms, a library that provides software TPM 2.0 emulation. When restoring TPM 2.0 state (for example during a virtual machine\u0027s power-on or state/migration restore), a malformed state blob can supply an oversized skip-block length that is not validated against the remaining size of the input buffer. This can drive an internal size counter negative, which bypasses a subsequent bounds check due to an unsafe signed-to-unsigned conversion, causing the parser to read memory outside the bounds of the heap buffer holding the state data. Successful exploitation can crash the process hosting libtpms (such as swtpm), resulting in a denial of service of the emulated TPM device and the virtual machine that depends on it. No data corruption or information disclosure was confirmed."
            }
          ],
          "metrics": [
            {
              "other": {
                "content": {
                  "namespace": "https://access.redhat.com/security/updates/classification/",
                  "value": "Moderate"
                },
                "type": "Red Hat severity rating"
              }
            },
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 6.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "format": "CVSS"
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-125",
                  "description": "Out-of-bounds Read",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-04T17:48:13.674Z",
            "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
            "shortName": "redhat"
          },
          "references": [
            {
              "tags": [
                "vdb-entry",
                "x_refsource_REDHAT"
              ],
              "url": "https://access.redhat.com/security/cve/CVE-2026-85769"
            },
            {
              "name": "RHBZ#2528538",
              "tags": [
                "issue-tracking",
                "x_refsource_REDHAT"
              ],
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528538"
            },
            {
              "url": "https://github.com/stefanberger/libtpms/commit/b1462888180d896af03cae0487e8d45009cc445e"
            },
            {
              "url": "https://github.com/stefanberger/libtpms/issues/614"
            }
          ],
          "timeline": [
            {
              "lang": "en",
              "time": "2026-09-01T00:00:00.000Z",
              "value": "Reported to Red Hat."
            },
            {
              "lang": "en",
              "time": "2026-09-04T00:00:00.000Z",
              "value": "Made public."
            }
          ],
          "title": "Libtpms: libtpms: heap out-of-bounds read in tpm2 state unmarshalling via unchecked block_skip_read() blocksize",
          "workarounds": [
            {
              "lang": "en",
              "value": "No mitigation is currently available that meets Red Hat Product Security\u0027s standards for usability, deployment, applicability, or stability."
            }
          ],
          "x_generator": {
            "engine": "cvelib 1.8.0"
          },
          "x_redhatCweChain": "CWE-125: Out-of-bounds Read"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "assignerShortName": "redhat",
        "cveId": "CVE-2026-85769",
        "datePublished": "2026-09-04T17:48:13.674Z",
        "dateReserved": "2026-09-04T15:19:09.987Z",
        "dateUpdated": "2026-09-04T18:51:12.453Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-85534 (GCVE-0-2026-85534)

    Vulnerability from cvelistv5 – Published: 2026-09-04 10:19 – Updated: 2026-09-04 16:07
    VLAI
    Title
    Libsoup: libsoup: http/2 client crash in on_data_source_read_callback when settings initial_window_size shrinks during deferred body read
    Summary
    A flaw was found in libsoup. When a client sends an HTTP/2 request body from a non-pollable input stream, the library can buffer more data than the current flow-control window later allows. A malicious HTTP/2 server can shrink SETTINGS_INITIAL_WINDOW_SIZE while that buffered read is still in progress. The client then copies the full buffer into a smaller DATA callback without a runtime bounds check, which can abort the process or fail the HTTP/2 session.
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-04 16:07 UTC
    CWE
    Impacted products
    Date Public
    2026-09-03 00:00
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-85534",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-04T16:07:03.334905Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-04T16:07:27.046Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:10"
              ],
              "defaultStatus": "affected",
              "packageName": "libsoup3",
              "product": "Red Hat Enterprise Linux 10",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:6"
              ],
              "defaultStatus": "unaffected",
              "packageName": "libsoup",
              "product": "Red Hat Enterprise Linux 6",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:7"
              ],
              "defaultStatus": "unaffected",
              "packageName": "libsoup",
              "product": "Red Hat Enterprise Linux 7",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:8"
              ],
              "defaultStatus": "unaffected",
              "packageName": "libsoup",
              "product": "Red Hat Enterprise Linux 8",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:9"
              ],
              "defaultStatus": "unaffected",
              "packageName": "libsoup",
              "product": "Red Hat Enterprise Linux 9",
              "vendor": "Red Hat"
            }
          ],
          "credits": [
            {
              "lang": "en",
              "value": "Red Hat would like to thank xtromera for reporting this issue."
            }
          ],
          "datePublic": "2026-09-03T00:00:00.000Z",
          "descriptions": [
            {
              "lang": "en",
              "value": "A flaw was found in libsoup. When a client sends an HTTP/2 request body from a non-pollable input stream, the library can buffer more data than the current flow-control window later allows. A malicious HTTP/2 server can shrink SETTINGS_INITIAL_WINDOW_SIZE while that buffered read is still in progress. The client then copies the full buffer into a smaller DATA callback without a runtime bounds check, which can abort the process or fail the HTTP/2 session."
            }
          ],
          "metrics": [
            {
              "other": {
                "content": {
                  "namespace": "https://access.redhat.com/security/updates/classification/",
                  "value": "Moderate"
                },
                "type": "Red Hat severity rating"
              }
            },
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 5.9,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "format": "CVSS"
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-617",
                  "description": "Reachable Assertion",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-04T10:19:22.562Z",
            "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
            "shortName": "redhat"
          },
          "references": [
            {
              "tags": [
                "vdb-entry",
                "x_refsource_REDHAT"
              ],
              "url": "https://access.redhat.com/security/cve/CVE-2026-85534"
            },
            {
              "name": "RHBZ#2528440",
              "tags": [
                "issue-tracking",
                "x_refsource_REDHAT"
              ],
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528440"
            },
            {
              "url": "https://gitlab.gnome.org/GNOME/libsoup/-/blob/master/libsoup/http2/soup-client-message-io-http2.c"
            },
            {
              "url": "https://gitlab.gnome.org/GNOME/libsoup/-/work_items/551"
            }
          ],
          "timeline": [
            {
              "lang": "en",
              "time": "2026-09-03T17:19:37.253Z",
              "value": "Reported to Red Hat."
            },
            {
              "lang": "en",
              "time": "2026-09-03T00:00:00.000Z",
              "value": "Made public."
            }
          ],
          "title": "Libsoup: libsoup: http/2 client crash in on_data_source_read_callback when settings initial_window_size shrinks during deferred body read",
          "workarounds": [
            {
              "lang": "en",
              "value": "Do not HTTP/2-upload from non-pollable streams (e.g. GFileInputStream) to untrusted servers. soup_message_set_request_body_from_bytes() is the pollable path. Assertions abort instead of returning an oversized length; that is not a fix."
            }
          ],
          "x_generator": {
            "engine": "cvelib 1.8.0"
          },
          "x_redhatCweChain": "CWE-617: Reachable Assertion"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "assignerShortName": "redhat",
        "cveId": "CVE-2026-85534",
        "datePublished": "2026-09-04T10:19:22.562Z",
        "dateReserved": "2026-09-04T08:57:22.995Z",
        "dateUpdated": "2026-09-04T16:07:27.046Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-81666 (GCVE-0-2026-81666)

    Vulnerability from cvelistv5 – Published: 2026-09-04 09:46 – Updated: 2026-09-04 09:46
    VLAI
    Title
    Corosync: corosync: integer overflow in check_memb_commit_token_sanity may bypass message length validation on 32-bit systems
    Summary
    An integer overflow was found in Corosync's handling of membership commit token messages. The length-validation check for these messages can be bypassed on 32-bit systems due to an integer overflow in the calculation of the expected message length, allowing a crafted network packet to trigger an out-of-bounds memory access that crashes the Corosync daemon. This results in a denial of service for the affected cluster node. The overflow does not occur on 64-bit systems, where the length calculation is correctly performed in 64-bit arithmetic.
    CWE
    • CWE-190 - Integer Overflow or Wraparound
    References
    URL Tags
    https://access.redhat.com/security/cve/CVE-2026-81666 vdb-entryx_refsource_REDHAT
    https://bugzilla.redhat.com/show_bug.cgi?id=2524923 issue-trackingx_refsource_REDHAT
    Impacted products
    Date Public
    2026-09-04 08:14
    Show details on NVD website

    {
      "containers": {
        "cna": {
          "affected": [
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:10"
              ],
              "defaultStatus": "affected",
              "packageName": "corosync",
              "product": "Red Hat Enterprise Linux 10",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:7"
              ],
              "defaultStatus": "affected",
              "packageName": "corosync",
              "product": "Red Hat Enterprise Linux 7",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:8"
              ],
              "defaultStatus": "affected",
              "packageName": "corosync",
              "product": "Red Hat Enterprise Linux 8",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:9"
              ],
              "defaultStatus": "affected",
              "packageName": "corosync",
              "product": "Red Hat Enterprise Linux 9",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:openshift:4"
              ],
              "defaultStatus": "affected",
              "packageName": "rhcos",
              "product": "Red Hat OpenShift Container Platform 4",
              "vendor": "Red Hat"
            }
          ],
          "credits": [
            {
              "lang": "en",
              "value": "Red Hat would like to thank Tristan Madani (Talence Security) for reporting this issue."
            }
          ],
          "datePublic": "2026-09-04T08:14:29.525Z",
          "descriptions": [
            {
              "lang": "en",
              "value": "An integer overflow was found in Corosync\u0027s handling of membership commit token messages. The length-validation check for these messages can be bypassed on 32-bit systems due to an integer overflow in the calculation of the expected message length, allowing a crafted network packet to trigger an out-of-bounds memory access that crashes the Corosync daemon. This results in a denial of service for the affected cluster node. The overflow does not occur on 64-bit systems, where the length calculation is correctly performed in 64-bit arithmetic."
            }
          ],
          "metrics": [
            {
              "other": {
                "content": {
                  "namespace": "https://access.redhat.com/security/updates/classification/",
                  "value": "Moderate"
                },
                "type": "Red Hat severity rating"
              }
            },
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 6.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "format": "CVSS"
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-190",
                  "description": "Integer Overflow or Wraparound",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-04T09:46:06.130Z",
            "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
            "shortName": "redhat"
          },
          "references": [
            {
              "tags": [
                "vdb-entry",
                "x_refsource_REDHAT"
              ],
              "url": "https://access.redhat.com/security/cve/CVE-2026-81666"
            },
            {
              "name": "RHBZ#2524923",
              "tags": [
                "issue-tracking",
                "x_refsource_REDHAT"
              ],
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524923"
            }
          ],
          "timeline": [
            {
              "lang": "en",
              "time": "2026-08-23T00:00:00.000Z",
              "value": "Reported to Red Hat."
            },
            {
              "lang": "en",
              "time": "2026-09-04T08:14:29.525Z",
              "value": "Made public."
            }
          ],
          "title": "Corosync: corosync: integer overflow in check_memb_commit_token_sanity may bypass message length validation on 32-bit systems",
          "workarounds": [
            {
              "lang": "en",
              "value": "There is no complete mitigation for this vulnerability short of a fix, but the following steps reduce risk:\n\n1. Ensure cluster message authentication is enabled in corosync.conf (crypto_cipher=aes256, crypto_hash=sha256 with a shared key from corosync-keygen), which is the default when clusters are configured via \u0027pcs cluster setup\u0027, and disabling it (cipher=none/hash=none) is an explicitly unsupported configuration per upstream maintainer guidance.\n2. Restrict network access to the cluster communication ports (default 5405-5412/UDP) to trusted cluster node addresses only.\n3. Where architecturally feasible, prefer 64-bit deployments, since the integer overflow described here does not occur on 64-bit systems."
            }
          ],
          "x_generator": {
            "engine": "cvelib 1.8.0"
          },
          "x_redhatCweChain": "CWE-190: Integer Overflow or Wraparound"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "assignerShortName": "redhat",
        "cveId": "CVE-2026-81666",
        "datePublished": "2026-09-04T09:46:06.130Z",
        "dateReserved": "2026-08-27T10:38:28.793Z",
        "dateUpdated": "2026-09-04T09:46:06.130Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-81665 (GCVE-0-2026-81665)

    Vulnerability from cvelistv5 – Published: 2026-09-04 09:05 – Updated: 2026-09-04 18:25
    VLAI
    Title
    Corosync: corosync: heap-based buffer overflow in totempg assembly buffer during fragmented message reassembly
    Summary
    A heap-based buffer overflow was found in Corosync's Totem Process Group (totempg) message reassembly. When processing fragmented multicast messages, the buffer used to reassemble fragments lacks a runtime bounds check in release builds. A network-adjacent attacker able to send crafted multicast protocol messages to the cluster could cause a heap buffer overflow with attacker-controlled data. This can crash the Corosync daemon, causing a denial of service to the entire cluster, and may potentially allow further exploitation given sufficient heap-corruption control.
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-04 17:09 UTC
    CWE
    • CWE-122 - Heap-based Buffer Overflow
    References
    URL Tags
    https://access.redhat.com/security/cve/CVE-2026-81665 vdb-entryx_refsource_REDHAT
    https://bugzilla.redhat.com/show_bug.cgi?id=2524910 issue-trackingx_refsource_REDHAT
    Impacted products
    Date Public
    2026-09-04 08:30
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-81665",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-04T17:09:13.395902Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-04T18:25:16.035Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:10"
              ],
              "defaultStatus": "affected",
              "packageName": "corosync",
              "product": "Red Hat Enterprise Linux 10",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:7"
              ],
              "defaultStatus": "affected",
              "packageName": "corosync",
              "product": "Red Hat Enterprise Linux 7",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:8"
              ],
              "defaultStatus": "affected",
              "packageName": "corosync",
              "product": "Red Hat Enterprise Linux 8",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:9"
              ],
              "defaultStatus": "affected",
              "packageName": "corosync",
              "product": "Red Hat Enterprise Linux 9",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:openshift:4"
              ],
              "defaultStatus": "affected",
              "packageName": "openshift/ose-rhel-coreos-9",
              "product": "Red Hat OpenShift Container Platform 4",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:openshift:4"
              ],
              "defaultStatus": "affected",
              "packageName": "rhcos",
              "product": "Red Hat OpenShift Container Platform 4",
              "vendor": "Red Hat"
            }
          ],
          "credits": [
            {
              "lang": "en",
              "value": "Red Hat would like to thank Tristan Madani (Talence Security) for reporting this issue."
            }
          ],
          "datePublic": "2026-09-04T08:30:05.029Z",
          "descriptions": [
            {
              "lang": "en",
              "value": "A heap-based buffer overflow was found in Corosync\u0027s Totem Process Group (totempg) message reassembly. When processing fragmented multicast messages, the buffer used to reassemble fragments lacks a runtime bounds check in release builds. A network-adjacent attacker able to send crafted multicast protocol messages to the cluster could cause a heap buffer overflow with attacker-controlled data. This can crash the Corosync daemon, causing a denial of service to the entire cluster, and may potentially allow further exploitation given sufficient heap-corruption control."
            }
          ],
          "metrics": [
            {
              "other": {
                "content": {
                  "namespace": "https://access.redhat.com/security/updates/classification/",
                  "value": "Important"
                },
                "type": "Red Hat severity rating"
              }
            },
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "format": "CVSS"
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-122",
                  "description": "Heap-based Buffer Overflow",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-04T09:05:35.890Z",
            "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
            "shortName": "redhat"
          },
          "references": [
            {
              "tags": [
                "vdb-entry",
                "x_refsource_REDHAT"
              ],
              "url": "https://access.redhat.com/security/cve/CVE-2026-81665"
            },
            {
              "name": "RHBZ#2524910",
              "tags": [
                "issue-tracking",
                "x_refsource_REDHAT"
              ],
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524910"
            }
          ],
          "timeline": [
            {
              "lang": "en",
              "time": "2026-08-23T00:00:00.000Z",
              "value": "Reported to Red Hat."
            },
            {
              "lang": "en",
              "time": "2026-09-04T08:30:05.029Z",
              "value": "Made public."
            }
          ],
          "title": "Corosync: corosync: heap-based buffer overflow in totempg assembly buffer during fragmented message reassembly",
          "workarounds": [
            {
              "lang": "en",
              "value": "There is no complete mitigation for this vulnerability short of a fix, but the following steps significantly reduce risk:\n\n1. Ensure cluster message authentication is enabled in corosync.conf: set crypto_cipher to aes256 and crypto_hash to sha256 (or stronger) in the totem {} block, with a shared key generated by corosync-keygen. This is the default when clusters are configured via \u0027pcs cluster setup\u0027, and disabling it (cipher=none/hash=none) is an explicitly unsupported configuration per upstream maintainer guidance.\n2. Restrict network access to the cluster communication ports (default 5405-5412/UDP) to trusted cluster node addresses only, using firewalld or other firewall rules.\n3. Ensure SELinux is running in enforcing mode on cluster nodes to limit the impact of any successful exploitation."
            }
          ],
          "x_generator": {
            "engine": "cvelib 1.8.0"
          },
          "x_redhatCweChain": "CWE-122: Heap-based Buffer Overflow"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "assignerShortName": "redhat",
        "cveId": "CVE-2026-81665",
        "datePublished": "2026-09-04T09:05:35.890Z",
        "dateReserved": "2026-08-27T10:38:28.793Z",
        "dateUpdated": "2026-09-04T18:25:16.035Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-85197 (GCVE-0-2026-85197)

    Vulnerability from cvelistv5 – Published: 2026-09-04 07:34 – Updated: 2026-09-04 18:15
    VLAI
    Title
    Libsoup: libsoup: heap use-after-free in libsoup http/2 client on_data_read() via goaway during body upload
    Summary
    A flaw was found in libsoup. A malicious HTTP/2 server or a Man-in-the-Middle (MITM) attacker can exploit a heap use-after-free vulnerability in the HTTP/2 client implementation. This occurs when a GNOME application uploads a file using HTTP/2, and the server sends a GOAWAY frame while the file body is being read asynchronously. This can lead to memory corruption, potentially resulting in information disclosure or arbitrary code execution.
    SSVC
    Exploitation: poc Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-04 18:15 UTC
    CWE
    Impacted products
    Date Public
    2026-09-03 13:00
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-85197",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-04T18:15:03.474491Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-04T18:15:28.916Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://gitlab.gnome.org/GNOME/libsoup/-/work_items/552"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:10"
              ],
              "defaultStatus": "affected",
              "packageName": "libsoup3",
              "product": "Red Hat Enterprise Linux 10",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:6"
              ],
              "defaultStatus": "unaffected",
              "packageName": "libsoup",
              "product": "Red Hat Enterprise Linux 6",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:7"
              ],
              "defaultStatus": "unaffected",
              "packageName": "libsoup",
              "product": "Red Hat Enterprise Linux 7",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:8"
              ],
              "defaultStatus": "unaffected",
              "packageName": "libsoup",
              "product": "Red Hat Enterprise Linux 8",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:9"
              ],
              "defaultStatus": "unaffected",
              "packageName": "libsoup",
              "product": "Red Hat Enterprise Linux 9",
              "vendor": "Red Hat"
            }
          ],
          "credits": [
            {
              "lang": "en",
              "value": "Red Hat would like to thank Naresh Kandula (Nottiboy_1337) for reporting this issue."
            }
          ],
          "datePublic": "2026-09-03T13:00:00.000Z",
          "descriptions": [
            {
              "lang": "en",
              "value": "A flaw was found in libsoup. A malicious HTTP/2 server or a Man-in-the-Middle (MITM) attacker can exploit a heap use-after-free vulnerability in the HTTP/2 client implementation. This occurs when a GNOME application uploads a file using HTTP/2, and the server sends a GOAWAY frame while the file body is being read asynchronously. This can lead to memory corruption, potentially resulting in information disclosure or arbitrary code execution."
            }
          ],
          "metrics": [
            {
              "other": {
                "content": {
                  "namespace": "https://access.redhat.com/security/updates/classification/",
                  "value": "Important"
                },
                "type": "Red Hat severity rating"
              }
            },
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.6,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H",
                "version": "3.1"
              },
              "format": "CVSS"
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-416",
                  "description": "Use After Free",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-04T14:42:53.055Z",
            "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
            "shortName": "redhat"
          },
          "references": [
            {
              "tags": [
                "vdb-entry",
                "x_refsource_REDHAT"
              ],
              "url": "https://access.redhat.com/security/cve/CVE-2026-85197"
            },
            {
              "name": "RHBZ#2528425",
              "tags": [
                "issue-tracking",
                "x_refsource_REDHAT"
              ],
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528425"
            },
            {
              "url": "https://gitlab.gnome.org/GNOME/libsoup/-/work_items/552"
            }
          ],
          "timeline": [
            {
              "lang": "en",
              "time": "2026-09-04T07:12:40.870Z",
              "value": "Reported to Red Hat."
            },
            {
              "lang": "en",
              "time": "2026-09-03T13:00:00.000Z",
              "value": "Made public."
            }
          ],
          "title": "Libsoup: libsoup: heap use-after-free in libsoup http/2 client on_data_read() via goaway during body upload",
          "workarounds": [
            {
              "lang": "en",
              "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
            }
          ],
          "x_generator": {
            "engine": "cvelib 1.8.0"
          },
          "x_redhatCweChain": "CWE-416: Use After Free"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "assignerShortName": "redhat",
        "cveId": "CVE-2026-85197",
        "datePublished": "2026-09-04T07:34:31.869Z",
        "dateReserved": "2026-09-03T12:45:28.161Z",
        "dateUpdated": "2026-09-04T18:15:28.916Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-84185 (GCVE-0-2026-84185)

    Vulnerability from cvelistv5 – Published: 2026-09-03 20:46 – Updated: 2026-09-04 18:57
    VLAI
    Title
    Jwcrypto: jwcrypto: general json jws kid binding bypass during jwkset verification
    Summary
    A flaw was found in the jwcrypto library, which is used for implementing Javascript Object Signing and Encryption (JOSE) standards. The issue occurs when the library verifies a General JSON Serialization JWS using a set of keys. Due to a coding error, the library fails to correctly identify the specific key ID (kid) and may instead accept a signature made by any valid key in the set. This can allow an attacker with a valid key to bypass authorization checks in applications that rely on the key ID to identify specific tenants or users.
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-04 18:52 UTC
    CWE
    • CWE-347 - Improper Verification of Cryptographic Signature
    References
    URL Tags
    https://access.redhat.com/security/cve/CVE-2026-84185 vdb-entryx_refsource_REDHAT
    https://bugzilla.redhat.com/show_bug.cgi?id=2526729 issue-trackingx_refsource_REDHAT
    Date Public
    2026-09-03 20:32
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-84185",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-04T18:52:38.110542Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-04T18:57:22.299Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:ansible_automation_platform:2"
              ],
              "defaultStatus": "affected",
              "packageName": "ansible-automation-platform-24/controller-rhel8",
              "product": "Red Hat Ansible Automation Platform 2",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:ansible_automation_platform:2"
              ],
              "defaultStatus": "affected",
              "packageName": "ansible-automation-platform-24/lightspeed-rhel8",
              "product": "Red Hat Ansible Automation Platform 2",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:ansible_automation_platform:2"
              ],
              "defaultStatus": "affected",
              "packageName": "ansible-automation-platform-25/controller-rhel8",
              "product": "Red Hat Ansible Automation Platform 2",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:ansible_automation_platform:2"
              ],
              "defaultStatus": "affected",
              "packageName": "ansible-automation-platform-25/gateway-rhel8",
              "product": "Red Hat Ansible Automation Platform 2",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:ansible_automation_platform:2"
              ],
              "defaultStatus": "affected",
              "packageName": "ansible-automation-platform-25/lightspeed-rhel8",
              "product": "Red Hat Ansible Automation Platform 2",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:ansible_automation_platform:2"
              ],
              "defaultStatus": "affected",
              "packageName": "ansible-automation-platform-26/controller-rhel9",
              "product": "Red Hat Ansible Automation Platform 2",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:ansible_automation_platform:2"
              ],
              "defaultStatus": "affected",
              "packageName": "ansible-automation-platform-26/gateway-rhel9",
              "product": "Red Hat Ansible Automation Platform 2",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:ansible_automation_platform:2"
              ],
              "defaultStatus": "affected",
              "packageName": "ansible-automation-platform-26/lightspeed-rhel9",
              "product": "Red Hat Ansible Automation Platform 2",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:ansible_automation_platform:2"
              ],
              "defaultStatus": "affected",
              "packageName": "ansible-automation-platform-27/gateway-rhel9",
              "product": "Red Hat Ansible Automation Platform 2",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:ansible_automation_platform:2"
              ],
              "defaultStatus": "affected",
              "packageName": "ansible-automation-platform-27/lightspeed-rhel9",
              "product": "Red Hat Ansible Automation Platform 2",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:ansible_automation_platform:2"
              ],
              "defaultStatus": "affected",
              "packageName": "automation-controller",
              "product": "Red Hat Ansible Automation Platform 2",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:ansible_automation_platform:2"
              ],
              "defaultStatus": "affected",
              "packageName": "python3.11-jwcrypto",
              "product": "Red Hat Ansible Automation Platform 2",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:ansible_automation_platform:2"
              ],
              "defaultStatus": "affected",
              "packageName": "python3.12-jwcrypto",
              "product": "Red Hat Ansible Automation Platform 2",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:10"
              ],
              "defaultStatus": "affected",
              "packageName": "python-jwcrypto",
              "product": "Red Hat Enterprise Linux 10",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:7"
              ],
              "defaultStatus": "affected",
              "packageName": "python-jwcrypto",
              "product": "Red Hat Enterprise Linux 7",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:8"
              ],
              "defaultStatus": "affected",
              "packageName": "idm:client/python-jwcrypto",
              "product": "Red Hat Enterprise Linux 8",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:8"
              ],
              "defaultStatus": "affected",
              "packageName": "idm:DL1/python-jwcrypto",
              "product": "Red Hat Enterprise Linux 8",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:9"
              ],
              "defaultStatus": "affected",
              "packageName": "python-jwcrypto",
              "product": "Red Hat Enterprise Linux 9",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:openshift_ai"
              ],
              "defaultStatus": "unaffected",
              "packageName": "rhoai/odh-feature-server-rhel9",
              "product": "Red Hat OpenShift AI (RHOAI)",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:openshift_ai"
              ],
              "defaultStatus": "unaffected",
              "packageName": "rhoai/odh-kserve-storage-initializer-rhel9",
              "product": "Red Hat OpenShift AI (RHOAI)",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:openstack:16.2"
              ],
              "defaultStatus": "unaffected",
              "packageName": "rhosp-rhel8/openstack-mistral-executor",
              "product": "Red Hat OpenStack Platform 16.2",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:openstack:16.2"
              ],
              "defaultStatus": "unaffected",
              "packageName": "rhosp-rhel8/openstack-nova-api",
              "product": "Red Hat OpenStack Platform 16.2",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:openstack:16.2"
              ],
              "defaultStatus": "unaffected",
              "packageName": "rhosp-rhel8/openstack-nova-compute-ironic",
              "product": "Red Hat OpenStack Platform 16.2",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:openstack:16.2"
              ],
              "defaultStatus": "unaffected",
              "packageName": "rhosp-rhel8/openstack-novajoin-base",
              "product": "Red Hat OpenStack Platform 16.2",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:openstack:16.2"
              ],
              "defaultStatus": "unaffected",
              "packageName": "rhosp-rhel8/openstack-novajoin-notifier",
              "product": "Red Hat OpenStack Platform 16.2",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:openstack:16.2"
              ],
              "defaultStatus": "unaffected",
              "packageName": "rhosp-rhel8/openstack-novajoin-server",
              "product": "Red Hat OpenStack Platform 16.2",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:openstack:16.2"
              ],
              "defaultStatus": "unaffected",
              "packageName": "rhosp-rhel8/openstack-tempest",
              "product": "Red Hat OpenStack Platform 16.2",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:openstack:16.2"
              ],
              "defaultStatus": "unaffected",
              "packageName": "rhosp-rhel8/openstack-tripleoclient",
              "product": "Red Hat OpenStack Platform 16.2",
              "vendor": "Red Hat"
            }
          ],
          "datePublic": "2026-09-03T20:32:00.000Z",
          "descriptions": [
            {
              "lang": "en",
              "value": "A flaw was found in the jwcrypto library, which is used for implementing Javascript Object Signing and Encryption (JOSE) standards. The issue occurs when the library verifies a General JSON Serialization JWS using a set of keys. Due to a coding error, the library fails to correctly identify the specific key ID (kid) and may instead accept a signature made by any valid key in the set. This can allow an attacker with a valid key to bypass authorization checks in applications that rely on the key ID to identify specific tenants or users."
            }
          ],
          "metrics": [
            {
              "other": {
                "content": {
                  "namespace": "https://access.redhat.com/security/updates/classification/",
                  "value": "Moderate"
                },
                "type": "Red Hat severity rating"
              }
            },
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 5.9,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N",
                "version": "3.1"
              },
              "format": "CVSS"
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-347",
                  "description": "Improper Verification of Cryptographic Signature",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-03T20:46:40.788Z",
            "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
            "shortName": "redhat"
          },
          "references": [
            {
              "tags": [
                "vdb-entry",
                "x_refsource_REDHAT"
              ],
              "url": "https://access.redhat.com/security/cve/CVE-2026-84185"
            },
            {
              "name": "RHBZ#2526729",
              "tags": [
                "issue-tracking",
                "x_refsource_REDHAT"
              ],
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2526729"
            }
          ],
          "timeline": [
            {
              "lang": "en",
              "time": "2026-09-01T10:22:42.646Z",
              "value": "Reported to Red Hat."
            },
            {
              "lang": "en",
              "time": "2026-09-03T20:32:00.000Z",
              "value": "Made public."
            }
          ],
          "title": "Jwcrypto: jwcrypto: general json jws kid binding bypass during jwkset verification",
          "workarounds": [
            {
              "lang": "en",
              "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
            }
          ],
          "x_generator": {
            "engine": "cvelib 1.8.0"
          },
          "x_redhatCweChain": "CWE-347: Improper Verification of Cryptographic Signature"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "assignerShortName": "redhat",
        "cveId": "CVE-2026-84185",
        "datePublished": "2026-09-03T20:46:40.788Z",
        "dateReserved": "2026-09-01T10:24:25.710Z",
        "dateUpdated": "2026-09-04T18:57:22.299Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-71224 (GCVE-0-2026-71224)

    Vulnerability from cvelistv5 – Published: 2026-09-03 12:23 – Updated: 2026-09-03 12:58
    VLAI
    Title
    Gfs2-utils: gfs2-utils: stack overflow via alloca(i_height) in metadata walk
    Summary
    A stack overflow vulnerability was found in gfs2-utils. The metadata walk code in metawalk.c uses alloca() with an untrusted inode height value from on-disk metadata without bounds validation, causing stack exhaustion and a denial of service when processing crafted GFS2 filesystem images.
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-03 12:57 UTC
    CWE
    • CWE-770 - Allocation of Resources Without Limits or Throttling
    References
    URL Tags
    https://access.redhat.com/security/cve/CVE-2026-71224 vdb-entryx_refsource_REDHAT
    https://bugzilla.redhat.com/show_bug.cgi?id=2511397 issue-trackingx_refsource_REDHAT
    Impacted products
    Vendor Product Version
    Red Hat Red Hat Enterprise Linux 7     cpe:/o:redhat:enterprise_linux:7
    Create a notification for this product.
    Red Hat Red Hat Enterprise Linux 8     cpe:/o:redhat:enterprise_linux:8
    Create a notification for this product.
    Red Hat Red Hat Enterprise Linux 9     cpe:/o:redhat:enterprise_linux:9
    Create a notification for this product.
    Date Public
    2026-09-03 11:50
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-71224",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-03T12:57:29.852983Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-03T12:58:06.407Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:7"
              ],
              "defaultStatus": "affected",
              "packageName": "gfs2-utils",
              "product": "Red Hat Enterprise Linux 7",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:8"
              ],
              "defaultStatus": "affected",
              "packageName": "gfs2-utils",
              "product": "Red Hat Enterprise Linux 8",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:9"
              ],
              "defaultStatus": "affected",
              "packageName": "gfs2-utils",
              "product": "Red Hat Enterprise Linux 9",
              "vendor": "Red Hat"
            }
          ],
          "credits": [
            {
              "lang": "en",
              "value": "Red Hat would like to thank Tristan Madani (Talence Security) for reporting this issue."
            }
          ],
          "datePublic": "2026-09-03T11:50:05.898Z",
          "descriptions": [
            {
              "lang": "en",
              "value": "A stack overflow vulnerability was found in gfs2-utils. The metadata walk code in metawalk.c uses alloca() with an untrusted inode height value from on-disk metadata without bounds validation, causing stack exhaustion and a denial of service when processing crafted GFS2 filesystem images."
            }
          ],
          "metrics": [
            {
              "other": {
                "content": {
                  "namespace": "https://access.redhat.com/security/updates/classification/",
                  "value": "Moderate"
                },
                "type": "Red Hat severity rating"
              }
            },
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 4.7,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "format": "CVSS"
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-770",
                  "description": "Allocation of Resources Without Limits or Throttling",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-03T12:23:31.604Z",
            "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
            "shortName": "redhat"
          },
          "references": [
            {
              "tags": [
                "vdb-entry",
                "x_refsource_REDHAT"
              ],
              "url": "https://access.redhat.com/security/cve/CVE-2026-71224"
            },
            {
              "name": "RHBZ#2511397",
              "tags": [
                "issue-tracking",
                "x_refsource_REDHAT"
              ],
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511397"
            }
          ],
          "timeline": [
            {
              "lang": "en",
              "time": "2026-06-10T00:00:00.000Z",
              "value": "Reported to Red Hat."
            },
            {
              "lang": "en",
              "time": "2026-09-03T11:50:05.898Z",
              "value": "Made public."
            }
          ],
          "title": "Gfs2-utils: gfs2-utils: stack overflow via alloca(i_height) in metadata walk",
          "workarounds": [
            {
              "lang": "en",
              "value": "Run gfs2-utils tools in a containerized or VM-isolated environment when processing potentially compromised or untrusted GFS2 filesystem images. Disable automatic fsck at boot for GFS2 filesystems until patches are applied by setting fs_passno to 0 in /etc/fstab. Use ulimit -s to reduce the stack size limit, converting potential exploitation into a controlled crash."
            }
          ],
          "x_generator": {
            "engine": "cvelib 1.8.0"
          },
          "x_redhatCweChain": "CWE-770: Allocation of Resources Without Limits or Throttling"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "assignerShortName": "redhat",
        "cveId": "CVE-2026-71224",
        "datePublished": "2026-09-03T12:23:31.604Z",
        "dateReserved": "2026-08-05T08:51:19.853Z",
        "dateUpdated": "2026-09-03T12:58:06.407Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-71222 (GCVE-0-2026-71222)

    Vulnerability from cvelistv5 – Published: 2026-09-03 12:23 – Updated: 2026-09-05 01:20
    VLAI
    Title
    Gfs2-utils: gfs2-utils: heap out-of-bounds read via unchecked ea_num_ptrs in extended attribute processing
    Summary
    A heap out-of-bounds read vulnerability was found in gfs2-utils. The ea_num_ptrs field from on-disk extended attribute metadata is consumed without bounds validation, causing a heap buffer over-read that may disclose sensitive memory contents or cause a crash when processing crafted GFS2 filesystem images.
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-05 01:20 UTC
    CWE
    References
    URL Tags
    https://access.redhat.com/security/cve/CVE-2026-71222 vdb-entryx_refsource_REDHAT
    https://bugzilla.redhat.com/show_bug.cgi?id=2511399 issue-trackingx_refsource_REDHAT
    Impacted products
    Vendor Product Version
    Red Hat Red Hat Enterprise Linux 7     cpe:/o:redhat:enterprise_linux:7
    Create a notification for this product.
    Red Hat Red Hat Enterprise Linux 8     cpe:/o:redhat:enterprise_linux:8
    Create a notification for this product.
    Red Hat Red Hat Enterprise Linux 9     cpe:/o:redhat:enterprise_linux:9
    Create a notification for this product.
    Date Public
    2026-09-03 11:49
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-71222",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-05T01:20:41.071089Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-05T01:20:51.104Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:7"
              ],
              "defaultStatus": "affected",
              "packageName": "gfs2-utils",
              "product": "Red Hat Enterprise Linux 7",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:8"
              ],
              "defaultStatus": "affected",
              "packageName": "gfs2-utils",
              "product": "Red Hat Enterprise Linux 8",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:9"
              ],
              "defaultStatus": "affected",
              "packageName": "gfs2-utils",
              "product": "Red Hat Enterprise Linux 9",
              "vendor": "Red Hat"
            }
          ],
          "credits": [
            {
              "lang": "en",
              "value": "Red Hat would like to thank Tristan Madani (Talence Security) for reporting this issue."
            }
          ],
          "datePublic": "2026-09-03T11:49:24.668Z",
          "descriptions": [
            {
              "lang": "en",
              "value": "A heap out-of-bounds read vulnerability was found in gfs2-utils. The ea_num_ptrs field from on-disk extended attribute metadata is consumed without bounds validation, causing a heap buffer over-read that may disclose sensitive memory contents or cause a crash when processing crafted GFS2 filesystem images."
            }
          ],
          "metrics": [
            {
              "other": {
                "content": {
                  "namespace": "https://access.redhat.com/security/updates/classification/",
                  "value": "Moderate"
                },
                "type": "Red Hat severity rating"
              }
            },
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "LOCAL",
                "availabilityImpact": "LOW",
                "baseScore": 5.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:L",
                "version": "3.1"
              },
              "format": "CVSS"
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-125",
                  "description": "Out-of-bounds Read",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-03T12:23:22.616Z",
            "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
            "shortName": "redhat"
          },
          "references": [
            {
              "tags": [
                "vdb-entry",
                "x_refsource_REDHAT"
              ],
              "url": "https://access.redhat.com/security/cve/CVE-2026-71222"
            },
            {
              "name": "RHBZ#2511399",
              "tags": [
                "issue-tracking",
                "x_refsource_REDHAT"
              ],
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511399"
            }
          ],
          "timeline": [
            {
              "lang": "en",
              "time": "2026-06-10T00:00:00.000Z",
              "value": "Reported to Red Hat."
            },
            {
              "lang": "en",
              "time": "2026-09-03T11:49:24.668Z",
              "value": "Made public."
            }
          ],
          "title": "Gfs2-utils: gfs2-utils: heap out-of-bounds read via unchecked ea_num_ptrs in extended attribute processing",
          "workarounds": [
            {
              "lang": "en",
              "value": "Do not process untrusted GFS2 filesystem images with gfs2-utils tools. Run gfs2-utils tools in a containerized or VM-isolated environment when processing untrusted images."
            }
          ],
          "x_generator": {
            "engine": "cvelib 1.8.0"
          },
          "x_redhatCweChain": "CWE-125: Out-of-bounds Read"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "assignerShortName": "redhat",
        "cveId": "CVE-2026-71222",
        "datePublished": "2026-09-03T12:23:22.616Z",
        "dateReserved": "2026-08-05T08:51:19.853Z",
        "dateUpdated": "2026-09-05T01:20:51.104Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-71221 (GCVE-0-2026-71221)

    Vulnerability from cvelistv5 – Published: 2026-09-03 12:23 – Updated: 2026-09-03 14:52
    VLAI
    Title
    Gfs2-utils: gfs2-utils: stack out-of-bounds write via unchecked height in savemeta
    Summary
    A stack out-of-bounds write vulnerability was found in gfs2-utils. In savemeta, the height value from on-disk inode metadata is used as a loop bound without bounds checking, causing a stack buffer overflow that may lead to arbitrary code execution when processing crafted GFS2 filesystem images.
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-03 14:07 UTC
    CWE
    References
    URL Tags
    https://access.redhat.com/security/cve/CVE-2026-71221 vdb-entryx_refsource_REDHAT
    https://bugzilla.redhat.com/show_bug.cgi?id=2511396 issue-trackingx_refsource_REDHAT
    Impacted products
    Vendor Product Version
    Red Hat Red Hat Enterprise Linux 7     cpe:/o:redhat:enterprise_linux:7
    Create a notification for this product.
    Red Hat Red Hat Enterprise Linux 8     cpe:/o:redhat:enterprise_linux:8
    Create a notification for this product.
    Red Hat Red Hat Enterprise Linux 9     cpe:/o:redhat:enterprise_linux:9
    Create a notification for this product.
    Date Public
    2026-09-03 11:45
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-71221",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-03T14:07:56.982491Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-03T14:30:00.002Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:7"
              ],
              "defaultStatus": "affected",
              "packageName": "gfs2-utils",
              "product": "Red Hat Enterprise Linux 7",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:8"
              ],
              "defaultStatus": "affected",
              "packageName": "gfs2-utils",
              "product": "Red Hat Enterprise Linux 8",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:9"
              ],
              "defaultStatus": "affected",
              "packageName": "gfs2-utils",
              "product": "Red Hat Enterprise Linux 9",
              "vendor": "Red Hat"
            }
          ],
          "credits": [
            {
              "lang": "en",
              "value": "Red Hat would like to thank Tristan Madani (Talence Security) for reporting this issue."
            }
          ],
          "datePublic": "2026-09-03T11:45:05.700Z",
          "descriptions": [
            {
              "lang": "en",
              "value": "A stack out-of-bounds write vulnerability was found in gfs2-utils. In savemeta, the height value from on-disk inode metadata is used as a loop bound without bounds checking, causing a stack buffer overflow that may lead to arbitrary code execution when processing crafted GFS2 filesystem images."
            }
          ],
          "metrics": [
            {
              "other": {
                "content": {
                  "namespace": "https://access.redhat.com/security/updates/classification/",
                  "value": "Moderate"
                },
                "type": "Red Hat severity rating"
              }
            },
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "format": "CVSS"
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-787",
                  "description": "Out-of-bounds Write",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-03T14:52:36.340Z",
            "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
            "shortName": "redhat"
          },
          "references": [
            {
              "tags": [
                "vdb-entry",
                "x_refsource_REDHAT"
              ],
              "url": "https://access.redhat.com/security/cve/CVE-2026-71221"
            },
            {
              "name": "RHBZ#2511396",
              "tags": [
                "issue-tracking",
                "x_refsource_REDHAT"
              ],
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511396"
            }
          ],
          "timeline": [
            {
              "lang": "en",
              "time": "2026-06-10T00:00:00.000Z",
              "value": "Reported to Red Hat."
            },
            {
              "lang": "en",
              "time": "2026-09-03T11:45:05.700Z",
              "value": "Made public."
            }
          ],
          "title": "Gfs2-utils: gfs2-utils: stack out-of-bounds write via unchecked height in savemeta",
          "workarounds": [
            {
              "lang": "en",
              "value": "Do not run gfs2-utils savemeta on untrusted or potentially compromised GFS2 filesystem images. Run gfs2-utils tools in a containerized or VM-isolated environment when processing untrusted images. Disable automatic fsck at boot for GFS2 filesystems until patches are applied by setting fs_passno to 0 in /etc/fstab."
            }
          ],
          "x_generator": {
            "engine": "cvelib 1.8.0"
          },
          "x_redhatCweChain": "CWE-787: Out-of-bounds Write"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "assignerShortName": "redhat",
        "cveId": "CVE-2026-71221",
        "datePublished": "2026-09-03T12:23:17.596Z",
        "dateReserved": "2026-08-05T08:51:19.853Z",
        "dateUpdated": "2026-09-03T14:52:36.340Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-71220 (GCVE-0-2026-71220)

    Vulnerability from cvelistv5 – Published: 2026-09-03 12:23 – Updated: 2026-09-03 14:52
    VLAI
    Title
    Gfs2-utils: gfs2-utils: stack out-of-bounds write via unchecked di_height in gfs2_edit
    Summary
    A stack out-of-bounds write vulnerability was found in gfs2-utils. In gfs2_edit, the di_height field from on-disk inode metadata is used as an array index without bounds checking, causing a stack buffer overflow that may lead to arbitrary code execution when processing crafted GFS2 filesystem images.
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-03 12:52 UTC
    CWE
    References
    URL Tags
    https://access.redhat.com/security/cve/CVE-2026-71220 vdb-entryx_refsource_REDHAT
    https://bugzilla.redhat.com/show_bug.cgi?id=2511398 issue-trackingx_refsource_REDHAT
    Impacted products
    Vendor Product Version
    Red Hat Red Hat Enterprise Linux 7     cpe:/o:redhat:enterprise_linux:7
    Create a notification for this product.
    Red Hat Red Hat Enterprise Linux 8     cpe:/o:redhat:enterprise_linux:8
    Create a notification for this product.
    Red Hat Red Hat Enterprise Linux 9     cpe:/o:redhat:enterprise_linux:9
    Create a notification for this product.
    Date Public
    2026-09-03 11:43
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-71220",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-03T12:52:57.593511Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-03T12:53:18.501Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:7"
              ],
              "defaultStatus": "affected",
              "packageName": "gfs2-utils",
              "product": "Red Hat Enterprise Linux 7",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:8"
              ],
              "defaultStatus": "affected",
              "packageName": "gfs2-utils",
              "product": "Red Hat Enterprise Linux 8",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:9"
              ],
              "defaultStatus": "affected",
              "packageName": "gfs2-utils",
              "product": "Red Hat Enterprise Linux 9",
              "vendor": "Red Hat"
            }
          ],
          "credits": [
            {
              "lang": "en",
              "value": "Red Hat would like to thank Tristan Madani (Talence Security) for reporting this issue."
            }
          ],
          "datePublic": "2026-09-03T11:43:38.063Z",
          "descriptions": [
            {
              "lang": "en",
              "value": "A stack out-of-bounds write vulnerability was found in gfs2-utils. In gfs2_edit, the di_height field from on-disk inode metadata is used as an array index without bounds checking, causing a stack buffer overflow that may lead to arbitrary code execution when processing crafted GFS2 filesystem images."
            }
          ],
          "metrics": [
            {
              "other": {
                "content": {
                  "namespace": "https://access.redhat.com/security/updates/classification/",
                  "value": "Moderate"
                },
                "type": "Red Hat severity rating"
              }
            },
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "format": "CVSS"
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-787",
                  "description": "Out-of-bounds Write",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-03T14:52:32.098Z",
            "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
            "shortName": "redhat"
          },
          "references": [
            {
              "tags": [
                "vdb-entry",
                "x_refsource_REDHAT"
              ],
              "url": "https://access.redhat.com/security/cve/CVE-2026-71220"
            },
            {
              "name": "RHBZ#2511398",
              "tags": [
                "issue-tracking",
                "x_refsource_REDHAT"
              ],
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511398"
            }
          ],
          "timeline": [
            {
              "lang": "en",
              "time": "2026-06-10T00:00:00.000Z",
              "value": "Reported to Red Hat."
            },
            {
              "lang": "en",
              "time": "2026-09-03T11:43:38.063Z",
              "value": "Made public."
            }
          ],
          "title": "Gfs2-utils: gfs2-utils: stack out-of-bounds write via unchecked di_height in gfs2_edit",
          "workarounds": [
            {
              "lang": "en",
              "value": "Do not run gfs2_edit on untrusted or potentially compromised GFS2 filesystem images. Run gfs2-utils tools in a containerized or VM-isolated environment when processing untrusted images. Disable automatic fsck at boot for GFS2 filesystems until patches are applied by setting fs_passno to 0 in /etc/fstab."
            }
          ],
          "x_generator": {
            "engine": "cvelib 1.8.0"
          },
          "x_redhatCweChain": "CWE-787: Out-of-bounds Write"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "assignerShortName": "redhat",
        "cveId": "CVE-2026-71220",
        "datePublished": "2026-09-03T12:23:12.906Z",
        "dateReserved": "2026-08-05T08:51:19.852Z",
        "dateUpdated": "2026-09-03T14:52:32.098Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-71219 (GCVE-0-2026-71219)

    Vulnerability from cvelistv5 – Published: 2026-09-03 12:23 – Updated: 2026-09-04 18:41
    VLAI
    Title
    Gfs2-utils: gfs2-utils: stack overflow via alloca(1<<di_depth) in hash table traversal
    Summary
    A stack overflow vulnerability was found in gfs2-utils. The hash table traversal code in metawalk.c uses alloca() with an exponentially-derived size from the untrusted on-disk di_depth field without bounds validation. A crafted GFS2 filesystem image with a large di_depth value causes stack exhaustion and a denial of service when processed by fsck.gfs2, gfs2_edit, or savemeta.
    SSVC
    Exploitation: none Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-04 18:41 UTC
    CWE
    • CWE-770 - Allocation of Resources Without Limits or Throttling
    References
    URL Tags
    https://access.redhat.com/security/cve/CVE-2026-71219 vdb-entryx_refsource_REDHAT
    https://bugzilla.redhat.com/show_bug.cgi?id=2507750 issue-trackingx_refsource_REDHAT
    Impacted products
    Vendor Product Version
    Red Hat Red Hat Enterprise Linux 7     cpe:/o:redhat:enterprise_linux:7
    Create a notification for this product.
    Red Hat Red Hat Enterprise Linux 8     cpe:/o:redhat:enterprise_linux:8
    Create a notification for this product.
    Red Hat Red Hat Enterprise Linux 9     cpe:/o:redhat:enterprise_linux:9
    Create a notification for this product.
    Date Public
    2026-09-03 11:40
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-71219",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-04T18:41:29.343480Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-04T18:41:38.906Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:7"
              ],
              "defaultStatus": "affected",
              "packageName": "gfs2-utils",
              "product": "Red Hat Enterprise Linux 7",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:8"
              ],
              "defaultStatus": "affected",
              "packageName": "gfs2-utils",
              "product": "Red Hat Enterprise Linux 8",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:9"
              ],
              "defaultStatus": "affected",
              "packageName": "gfs2-utils",
              "product": "Red Hat Enterprise Linux 9",
              "vendor": "Red Hat"
            }
          ],
          "credits": [
            {
              "lang": "en",
              "value": "Red Hat would like to thank Tristan Madani (Talence Security) for reporting this issue."
            }
          ],
          "datePublic": "2026-09-03T11:40:42.944Z",
          "descriptions": [
            {
              "lang": "en",
              "value": "A stack overflow vulnerability was found in gfs2-utils. The hash table traversal code in metawalk.c uses alloca() with an exponentially-derived size from the untrusted on-disk di_depth field without bounds validation. A crafted GFS2 filesystem image with a large di_depth value causes stack exhaustion and a denial of service when processed by fsck.gfs2, gfs2_edit, or savemeta."
            }
          ],
          "metrics": [
            {
              "other": {
                "content": {
                  "namespace": "https://access.redhat.com/security/updates/classification/",
                  "value": "Moderate"
                },
                "type": "Red Hat severity rating"
              }
            },
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 4.7,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "format": "CVSS"
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-770",
                  "description": "Allocation of Resources Without Limits or Throttling",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-03T12:23:06.486Z",
            "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
            "shortName": "redhat"
          },
          "references": [
            {
              "tags": [
                "vdb-entry",
                "x_refsource_REDHAT"
              ],
              "url": "https://access.redhat.com/security/cve/CVE-2026-71219"
            },
            {
              "name": "RHBZ#2507750",
              "tags": [
                "issue-tracking",
                "x_refsource_REDHAT"
              ],
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507750"
            }
          ],
          "timeline": [
            {
              "lang": "en",
              "time": "2026-06-10T00:00:00.000Z",
              "value": "Reported to Red Hat."
            },
            {
              "lang": "en",
              "time": "2026-09-03T11:40:42.944Z",
              "value": "Made public."
            }
          ],
          "title": "Gfs2-utils: gfs2-utils: stack overflow via alloca(1\u003c\u003cdi_depth) in hash table traversal",
          "workarounds": [
            {
              "lang": "en",
              "value": "Run gfs2-utils tools in a containerized or VM-isolated environment when processing potentially compromised or untrusted GFS2 filesystem images. Disable automatic fsck at boot for GFS2 filesystems until patches are applied by setting fs_passno to 0 in /etc/fstab. Use ulimit -s to reduce the stack size limit, converting potential exploitation into a controlled crash."
            }
          ],
          "x_generator": {
            "engine": "cvelib 1.8.0"
          },
          "x_redhatCweChain": "CWE-770: Allocation of Resources Without Limits or Throttling"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "assignerShortName": "redhat",
        "cveId": "CVE-2026-71219",
        "datePublished": "2026-09-03T12:23:06.486Z",
        "dateReserved": "2026-08-05T08:51:19.852Z",
        "dateUpdated": "2026-09-04T18:41:38.906Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-85150 (GCVE-0-2026-85150)

    Vulnerability from cvelistv5 – Published: 2026-09-03 10:47 – Updated: 2026-09-03 12:34
    VLAI
    Title
    Gstreamer1-plugins-base: gstreamer: null/invalid-pointer dereference in gst_rtsp_message_parse_auth_credentials() when parsing a crafted digest authorization/www-authenticate header
    Summary
    A NULL pointer dereference flaw was found in GStreamer's RTSP support library. The vulnerability occurs while parsing an Authorization or WWW-Authenticate header that uses Digest authentication. Specially crafted whitespace placement around a parameter's terminator can cause an internal length calculation to underflow, leading to a crash of the process parsing the header. On an RTSP server this can be triggered by a remote, unauthenticated attacker sending a single malformed request when the server has authentication enabled; the same flaw can also be triggered against an RTSP client by a malicious or compromised RTSP server. Successful exploitation results in a denial of service (application crash) and has no confirmed impact on confidentiality or integrity.
    SSVC
    Exploitation: none Automatable: yes Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-03 12:33 UTC
    CWE
    • CWE-476 - NULL Pointer Dereference
    Impacted products
    Date Public
    2026-09-03 10:25
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-85150",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-03T12:33:40.281754Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-03T12:34:05.679Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:10"
              ],
              "defaultStatus": "affected",
              "packageName": "gstreamer1-plugins-base",
              "product": "Red Hat Enterprise Linux 10",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:7"
              ],
              "defaultStatus": "affected",
              "packageName": "gstreamer1-plugins-base",
              "product": "Red Hat Enterprise Linux 7",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:8"
              ],
              "defaultStatus": "affected",
              "packageName": "gstreamer1-plugins-base",
              "product": "Red Hat Enterprise Linux 8",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/o:redhat:enterprise_linux:9"
              ],
              "defaultStatus": "affected",
              "packageName": "gstreamer1-plugins-base",
              "product": "Red Hat Enterprise Linux 9",
              "vendor": "Red Hat"
            }
          ],
          "credits": [
            {
              "lang": "en",
              "value": "Upstream acknowledges Roy Lau (Independent researcher) as the original reporter."
            }
          ],
          "datePublic": "2026-09-03T10:25:00.000Z",
          "descriptions": [
            {
              "lang": "en",
              "value": "A NULL pointer dereference flaw was found in GStreamer\u0027s RTSP support library. The vulnerability occurs while parsing an Authorization or WWW-Authenticate header that uses Digest authentication. Specially crafted whitespace placement around a parameter\u0027s terminator can cause an internal length calculation to underflow, leading to a crash of the process parsing the header. On an RTSP server this can be triggered by a remote, unauthenticated attacker sending a single malformed request when the server has authentication enabled; the same flaw can also be triggered against an RTSP client by a malicious or compromised RTSP server. Successful exploitation results in a denial of service (application crash) and has no confirmed impact on confidentiality or integrity."
            }
          ],
          "metrics": [
            {
              "other": {
                "content": {
                  "namespace": "https://access.redhat.com/security/updates/classification/",
                  "value": "Moderate"
                },
                "type": "Red Hat severity rating"
              }
            },
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "format": "CVSS"
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-476",
                  "description": "NULL Pointer Dereference",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-03T10:47:10.711Z",
            "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
            "shortName": "redhat"
          },
          "references": [
            {
              "tags": [
                "vdb-entry",
                "x_refsource_REDHAT"
              ],
              "url": "https://access.redhat.com/security/cve/CVE-2026-85150"
            },
            {
              "name": "RHBZ#2527936",
              "tags": [
                "issue-tracking",
                "x_refsource_REDHAT"
              ],
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2527936"
            },
            {
              "url": "https://gitlab.freedesktop.org/gstreamer/gstreamer-security/-/merge_requests/120"
            },
            {
              "url": "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/blob/main/subprojects/gst-plugins-base/gst-libs/gst/rtsp/gstrtspmessage.c#L1408"
            }
          ],
          "timeline": [
            {
              "lang": "en",
              "time": "2026-08-26T00:00:00.000Z",
              "value": "Reported to Red Hat."
            },
            {
              "lang": "en",
              "time": "2026-09-03T10:25:00.000Z",
              "value": "Made public."
            }
          ],
          "title": "Gstreamer1-plugins-base: gstreamer: null/invalid-pointer dereference in gst_rtsp_message_parse_auth_credentials() when parsing a crafted digest authorization/www-authenticate header",
          "workarounds": [
            {
              "lang": "en",
              "value": "No mitigation is currently available that meets Red Hat Product Security\u0027s standards for usability, deployment, applicability, or stability."
            }
          ],
          "x_generator": {
            "engine": "cvelib 1.8.0"
          },
          "x_redhatCweChain": "CWE-476: NULL Pointer Dereference"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "assignerShortName": "redhat",
        "cveId": "CVE-2026-85150",
        "datePublished": "2026-09-03T10:47:10.711Z",
        "dateReserved": "2026-09-03T10:21:17.760Z",
        "dateUpdated": "2026-09-03T12:34:05.679Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CVE-2026-66786 (GCVE-0-2026-66786)

    Vulnerability from cvelistv5 – Published: 2026-09-02 17:57 – Updated: 2026-09-05 01:01
    VLAI
    Title
    Submariner: submariner: ipsec.conf stanza injection via remote-supplied cablename and subnets
    Summary
    A flaw was found in submariner. In cert-auth mode, the connection configuration is built using free-form strings from the Custom Resource Definition (CRD) without proper validation. A malicious cluster can exploit this by publishing a CableName that includes newlines and ipsec.conf directives. This allows an attacker to inject arbitrary configuration parameters or execute commands through leftupdown hooks, leading to remote code execution as root on the gateway node.
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-05 01:01 UTC
    CWE
    • CWE-94 - Improper Control of Generation of Code ('Code Injection')
    References
    URL Tags
    https://access.redhat.com/errata/RHSA-2026:63016 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/security/cve/CVE-2026-66786 vdb-entryx_refsource_REDHAT
    https://bugzilla.redhat.com/show_bug.cgi?id=2507531 issue-trackingx_refsource_REDHAT
    Impacted products
    Vendor Product Version
    Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.17 Unaffected: 1788023916 , < * (rpm)
        cpe:/a:redhat:acm:2.17::el9
    Create a notification for this product.
    Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.17 Unaffected: 1788023940 , < * (rpm)
        cpe:/a:redhat:acm:2.17::el9
    Create a notification for this product.
    Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.17 Unaffected: 1788105072 , < * (rpm)
        cpe:/a:redhat:acm:2.17::el9
    Create a notification for this product.
    Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.17 Unaffected: 1788043964 , < * (rpm)
        cpe:/a:redhat:acm:2.17::el9
    Create a notification for this product.
    Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.17 Unaffected: 1788043961 , < * (rpm)
        cpe:/a:redhat:acm:2.17::el9
    Create a notification for this product.
    Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.17 Unaffected: 1788073481 , < * (rpm)
        cpe:/a:redhat:acm:2.17::el9
    Create a notification for this product.
    Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.17 Unaffected: 1788043970 , < * (rpm)
        cpe:/a:redhat:acm:2.17::el9
    Create a notification for this product.
    Red Hat Red Hat Advanced Cluster Management for Kubernetes 2     cpe:/a:redhat:acm:2
    Create a notification for this product.
    Date Public
    2026-08-21 16:43
    Show details on NVD website

    {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-66786",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-05T01:01:16.851937Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-05T01:01:30.464Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "collectionURL": "https://catalog.redhat.com/software/containers/",
              "cpes": [
                "cpe:/a:redhat:acm:2.17::el9"
              ],
              "defaultStatus": "affected",
              "packageName": "rhacm2/lighthouse-agent-rhel9",
              "product": "Red Hat Advanced Cluster Management for Kubernetes 2.17",
              "vendor": "Red Hat",
              "versions": [
                {
                  "lessThan": "*",
                  "status": "unaffected",
                  "version": "1788023916",
                  "versionType": "rpm"
                }
              ]
            },
            {
              "collectionURL": "https://catalog.redhat.com/software/containers/",
              "cpes": [
                "cpe:/a:redhat:acm:2.17::el9"
              ],
              "defaultStatus": "affected",
              "packageName": "rhacm2/lighthouse-coredns-rhel9",
              "product": "Red Hat Advanced Cluster Management for Kubernetes 2.17",
              "vendor": "Red Hat",
              "versions": [
                {
                  "lessThan": "*",
                  "status": "unaffected",
                  "version": "1788023940",
                  "versionType": "rpm"
                }
              ]
            },
            {
              "collectionURL": "https://catalog.redhat.com/software/containers/",
              "cpes": [
                "cpe:/a:redhat:acm:2.17::el9"
              ],
              "defaultStatus": "affected",
              "packageName": "rhacm2/subctl-rhel9",
              "product": "Red Hat Advanced Cluster Management for Kubernetes 2.17",
              "vendor": "Red Hat",
              "versions": [
                {
                  "lessThan": "*",
                  "status": "unaffected",
                  "version": "1788105072",
                  "versionType": "rpm"
                }
              ]
            },
            {
              "collectionURL": "https://catalog.redhat.com/software/containers/",
              "cpes": [
                "cpe:/a:redhat:acm:2.17::el9"
              ],
              "defaultStatus": "affected",
              "packageName": "rhacm2/submariner-gateway-rhel9",
              "product": "Red Hat Advanced Cluster Management for Kubernetes 2.17",
              "vendor": "Red Hat",
              "versions": [
                {
                  "lessThan": "*",
                  "status": "unaffected",
                  "version": "1788043964",
                  "versionType": "rpm"
                }
              ]
            },
            {
              "collectionURL": "https://catalog.redhat.com/software/containers/",
              "cpes": [
                "cpe:/a:redhat:acm:2.17::el9"
              ],
              "defaultStatus": "affected",
              "packageName": "rhacm2/submariner-globalnet-rhel9",
              "product": "Red Hat Advanced Cluster Management for Kubernetes 2.17",
              "vendor": "Red Hat",
              "versions": [
                {
                  "lessThan": "*",
                  "status": "unaffected",
                  "version": "1788043961",
                  "versionType": "rpm"
                }
              ]
            },
            {
              "collectionURL": "https://catalog.redhat.com/software/containers/",
              "cpes": [
                "cpe:/a:redhat:acm:2.17::el9"
              ],
              "defaultStatus": "affected",
              "packageName": "rhacm2/submariner-rhel9-operator",
              "product": "Red Hat Advanced Cluster Management for Kubernetes 2.17",
              "vendor": "Red Hat",
              "versions": [
                {
                  "lessThan": "*",
                  "status": "unaffected",
                  "version": "1788073481",
                  "versionType": "rpm"
                }
              ]
            },
            {
              "collectionURL": "https://catalog.redhat.com/software/containers/",
              "cpes": [
                "cpe:/a:redhat:acm:2.17::el9"
              ],
              "defaultStatus": "affected",
              "packageName": "rhacm2/submariner-route-agent-rhel9",
              "product": "Red Hat Advanced Cluster Management for Kubernetes 2.17",
              "vendor": "Red Hat",
              "versions": [
                {
                  "lessThan": "*",
                  "status": "unaffected",
                  "version": "1788043970",
                  "versionType": "rpm"
                }
              ]
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:acm:2"
              ],
              "defaultStatus": "affected",
              "packageName": "rhacm2/submariner-addon-rhel9",
              "product": "Red Hat Advanced Cluster Management for Kubernetes 2",
              "vendor": "Red Hat"
            },
            {
              "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
              "cpes": [
                "cpe:/a:redhat:acm:2"
              ],
              "defaultStatus": "affected",
              "packageName": "rhacm2/submariner-operator-bundle",
              "product": "Red Hat Advanced Cluster Management for Kubernetes 2",
              "vendor": "Red Hat"
            }
          ],
          "datePublic": "2026-08-21T16:43:00.583Z",
          "descriptions": [
            {
              "lang": "en",
              "value": "A flaw was found in submariner. In cert-auth mode, the connection configuration is built using free-form strings from the Custom Resource Definition (CRD) without proper validation. A malicious cluster can exploit this by publishing a CableName that includes newlines and ipsec.conf directives. This allows an attacker to inject arbitrary configuration parameters or execute commands through leftupdown hooks, leading to remote code execution as root on the gateway node."
            }
          ],
          "metrics": [
            {
              "other": {
                "content": {
                  "namespace": "https://access.redhat.com/security/updates/classification/",
                  "value": "Moderate"
                },
                "type": "Red Hat severity rating"
              }
            },
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.1,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "HIGH",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
                "version": "3.1"
              },
              "format": "CVSS"
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-94",
                  "description": "Improper Control of Generation of Code (\u0027Code Injection\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-03T04:41:49.247Z",
            "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
            "shortName": "redhat"
          },
          "references": [
            {
              "name": "RHSA-2026:63016",
              "tags": [
                "vendor-advisory",
                "x_refsource_REDHAT"
              ],
              "url": "https://access.redhat.com/errata/RHSA-2026:63016"
            },
            {
              "tags": [
                "vdb-entry",
                "x_refsource_REDHAT"
              ],
              "url": "https://access.redhat.com/security/cve/CVE-2026-66786"
            },
            {
              "name": "RHBZ#2507531",
              "tags": [
                "issue-tracking",
                "x_refsource_REDHAT"
              ],
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507531"
            }
          ],
          "timeline": [
            {
              "lang": "en",
              "time": "2026-07-27T00:00:00.000Z",
              "value": "Reported to Red Hat."
            },
            {
              "lang": "en",
              "time": "2026-08-21T16:43:00.583Z",
              "value": "Made public."
            }
          ],
          "title": "Submariner: submariner: ipsec.conf stanza injection via remote-supplied cablename and subnets",
          "workarounds": [
            {
              "lang": "en",
              "value": "If Submariner certificate-based IPsec authentication mode is enabled (`IPSecCertAuthMode: true` in the SubmarinerConfig), administrators can mitigate this flaw by switching to the default pre-shared key (PSK) authentication mode. Set `IPSecCertAuthMode: false` (or remove the field to use its default value) in the SubmarinerConfig CR and redeploy the Submariner gateway pods. PSK mode provides equivalent inter-cluster IPsec tunnel encryption and is not affected by this vulnerability. Note that disabling cert-auth mode means Submariner will no longer integrate with OVN IPsec\u0027s certificate infrastructure and will manage its own PSK-based authentication independently."
            }
          ],
          "x_generator": {
            "engine": "cvelib 1.8.0"
          },
          "x_redhatCweChain": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "assignerShortName": "redhat",
        "cveId": "CVE-2026-66786",
        "datePublished": "2026-09-02T17:57:19.436Z",
        "dateReserved": "2026-07-27T17:51:24.885Z",
        "dateUpdated": "2026-09-05T01:01:30.464Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }

    CERTFR-2026-AVI-1118

    Vulnerability from certfr_avis - Published: 2026-09-04 - Updated: 2026-09-04

    De multiples vulnérabilités ont été découvertes dans le noyau Linux de Red Hat. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire, une élévation de privilèges et un déni de service à distance.

    Solutions

    Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

    Impacted products
    Vendor Product Description
    Red Hat Red Hat Enterprise Linux Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.6 x86_64
    Red Hat Red Hat Enterprise Linux Server Red Hat Enterprise Linux Server - AUS 8.6 x86_64
    Red Hat Red Hat Enterprise Linux Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 10.0 s390x
    Red Hat Red Hat Enterprise Linux Red Hat Enterprise Linux for Power, little endian 8 ppc64le
    Red Hat Red Hat Enterprise Linux Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.2 ppc64le
    Red Hat Red Hat Enterprise Linux Server Red Hat Enterprise Linux Server - AUS 8.4 x86_64
    Red Hat Red Hat Enterprise Linux Red Hat Enterprise Linux for IBM z Systems 8 s390x
    Red Hat Red Hat CodeReady Linux Builder Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 10.2 ppc64le
    Red Hat Red Hat CodeReady Linux Builder Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 10.0 s390x
    Red Hat Red Hat Enterprise Linux Red Hat Enterprise Linux for x86_64 - Extended Update Support 10.2 x86_64
    Red Hat Red Hat Enterprise Linux Red Hat Enterprise Linux for x86_64 8 x86_64
    Red Hat Red Hat Enterprise Linux Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.2 s390x
    Red Hat Red Hat Enterprise Linux Red Hat Enterprise Linux for x86_64 10 x86_64
    Red Hat Red Hat Enterprise Linux Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.6 ppc64le
    Red Hat Red Hat Enterprise Linux Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.4 ppc64le
    Red Hat Red Hat Enterprise Linux Server Red Hat Enterprise Linux Server - TUS 8.8 x86_64
    Red Hat Red Hat Enterprise Linux Red Hat Enterprise Linux for Real Time 8 x86_64
    Red Hat Red Hat Enterprise Linux Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.6 s390x
    Red Hat Red Hat Enterprise Linux Red Hat Enterprise Linux for x86_64 - Extended Update Support 10.0 x86_64
    Red Hat Red Hat Enterprise Linux Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.8 x86_64
    Red Hat Red Hat Enterprise Linux Red Hat Enterprise Linux for x86_64 - 4 years of updates 10.0 x86_64
    Red Hat Red Hat Enterprise Linux Server Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.4 ppc64le
    Red Hat Red Hat Enterprise Linux Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.2 x86_64
    Red Hat Red Hat CodeReady Linux Builder Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 10.0 ppc64le
    Red Hat Red Hat Enterprise Linux Server Red Hat Enterprise Linux Server - AUS 9.6 x86_64
    Red Hat Red Hat Enterprise Linux Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.6 s390x
    Red Hat Red Hat CodeReady Linux Builder Red Hat CodeReady Linux Builder for x86_64 10 x86_64
    Red Hat Red Hat Enterprise Linux Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.4 x86_64
    Red Hat Red Hat Enterprise Linux Red Hat Enterprise Linux for ARM 64 - Extended Update Support 10.2 aarch64
    Red Hat Red Hat CodeReady Linux Builder Red Hat CodeReady Linux Builder for IBM z Systems 10 s390x
    Red Hat Red Hat Enterprise Linux Red Hat Enterprise Linux for Power, little endian - 4 years of support 10.2 ppc64le
    Red Hat Red Hat Enterprise Linux Red Hat Enterprise Linux for Power, little endian - 4 years of support 10.0 ppc64le
    Red Hat Red Hat Enterprise Linux Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 10.2 x86_64
    Red Hat Red Hat Enterprise Linux Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.6 x86_64
    Red Hat Red Hat Enterprise Linux Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 8.10 x86_64
    Red Hat Red Hat Enterprise Linux Server Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.6 ppc64le
    Red Hat Red Hat Enterprise Linux Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.4 aarch64
    Red Hat Red Hat Enterprise Linux Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.6 aarch64
    Red Hat Red Hat Enterprise Linux Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.4 s390x
    Red Hat Red Hat Enterprise Linux Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.2 x86_64
    Red Hat Red Hat Enterprise Linux Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.6 aarch64
    Red Hat Red Hat Enterprise Linux Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 8.10 s390x
    Red Hat Red Hat Enterprise Linux Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.6 s390x
    Red Hat Red Hat Enterprise Linux Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.4 aarch64
    Red Hat Red Hat Enterprise Linux Red Hat Enterprise Linux for Real Time for x86_64 - Extended Life Cycle Support 7 x86_64
    Red Hat Red Hat Enterprise Linux Red Hat Enterprise Linux for ARM 64 8 aarch64
    Red Hat Red Hat Enterprise Linux Red Hat Enterprise Linux for ARM 64 10 aarch64
    Red Hat Red Hat CodeReady Linux Builder Red Hat CodeReady Linux Builder for ARM 64 8 aarch64
    Red Hat Red Hat CodeReady Linux Builder Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 10.2 s390x
    Red Hat Red Hat Enterprise Linux Red Hat Enterprise Linux for Power, little endian - Extended Update Support 10.0 ppc64le
    Red Hat Red Hat Enterprise Linux Red Hat Enterprise Linux for ARM 64 - 4 years of updates 10.2 aarch64
    Red Hat Red Hat CodeReady Linux Builder Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 9.6 s390x
    Red Hat Red Hat Enterprise Linux Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.4 x86_64
    Red Hat Red Hat Enterprise Linux Red Hat Enterprise Linux for Real Time for NFV 8 x86_64
    Red Hat Red Hat Enterprise Linux Server Red Hat Enterprise Linux Server - AUS 9.4 x86_64
    Red Hat Red Hat Enterprise Linux Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.6 aarch64
    Red Hat Red Hat CodeReady Linux Builder Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 10.2 aarch64
    Red Hat Red Hat Enterprise Linux Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 10.2 ppc64le
    Red Hat Red Hat Enterprise Linux Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.6 ppc64le
    Red Hat Red Hat CodeReady Linux Builder Red Hat CodeReady Linux Builder for x86_64 8 x86_64
    Red Hat Red Hat CodeReady Linux Builder Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 10.0 aarch64
    Red Hat Red Hat Enterprise Linux Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.6 x86_64
    Red Hat Red Hat Enterprise Linux Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.2 s390x
    Red Hat Red Hat Enterprise Linux Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 8.10 aarch64
    Red Hat Red Hat Enterprise Linux Red Hat Enterprise Linux for x86_64 - 4 years of updates 10.2 x86_64
    Red Hat Red Hat Enterprise Linux Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 10.0 s390x
    Red Hat Red Hat Enterprise Linux Server Red Hat Enterprise Linux Server - AUS 9.2 x86_64
    Red Hat Red Hat CodeReady Linux Builder Red Hat CodeReady Linux Builder for ARM 64 10 aarch64
    Red Hat Red Hat Enterprise Linux Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.4 s390x
    Red Hat Red Hat Enterprise Linux Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 10.2 s390x
    Red Hat Red Hat CodeReady Linux Builder Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 10.0 x86_64
    Red Hat Red Hat CodeReady Linux Builder Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 9.6 aarch64
    Red Hat Red Hat Enterprise Linux Red Hat Enterprise Linux for x86_64 - Extended Life Cycle Long Life 8.8 x86_64
    Red Hat Red Hat CodeReady Linux Builder Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 9.6 x86_64
    Red Hat Red Hat Enterprise Linux Red Hat Enterprise Linux for Power, little endian - Extended Update Support 10.2 ppc64le
    Red Hat Red Hat Enterprise Linux Red Hat Enterprise Linux for x86_64 - Extended Life Cycle Long Life 8.6 x86_64
    Red Hat Red Hat Enterprise Linux Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 10.2 s390x
    Red Hat Red Hat Enterprise Linux Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 8.10 ppc64le
    Red Hat Red Hat CodeReady Linux Builder Red Hat CodeReady Linux Builder for Power, little endian 8 ppc64le
    Red Hat Red Hat Enterprise Linux Server Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.8 ppc64le
    Red Hat Red Hat Enterprise Linux Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.2 aarch64
    Red Hat Red Hat Enterprise Linux Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 10.2 s390x
    Red Hat Red Hat Enterprise Linux Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.2 aarch64
    Red Hat Red Hat Enterprise Linux Red Hat Enterprise Linux for IBM z Systems 10 s390x
    Red Hat Red Hat Enterprise Linux Red Hat Enterprise Linux for Power, little endian 10 ppc64le
    Red Hat Red Hat CodeReady Linux Builder Red Hat CodeReady Linux Builder for Power, little endian 10 ppc64le
    Red Hat Red Hat Enterprise Linux Red Hat Enterprise Linux for x86_64 - Extended Life Cycle Long Life 8.4 x86_64
    Red Hat Red Hat Enterprise Linux Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 10.2 aarch64
    Red Hat Red Hat Enterprise Linux Server Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.2 ppc64le
    Red Hat Red Hat Enterprise Linux Red Hat Enterprise Linux for ARM 64 - 4 years of updates 10.0 aarch64
    Red Hat Red Hat Enterprise Linux Red Hat Enterprise Linux for ARM 64 - Extended Update Support 10.0 aarch64

    Show details on source website

    {
      "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
      "affected_systems": [
        {
          "description": "Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.6 x86_64",
          "product": {
            "name": "Red Hat Enterprise Linux",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat Enterprise Linux Server - AUS 8.6 x86_64",
          "product": {
            "name": "Red Hat Enterprise Linux Server",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 10.0 s390x",
          "product": {
            "name": "Red Hat Enterprise Linux",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat Enterprise Linux for Power, little endian 8 ppc64le",
          "product": {
            "name": "Red Hat Enterprise Linux",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.2 ppc64le",
          "product": {
            "name": "Red Hat Enterprise Linux",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat Enterprise Linux Server - AUS 8.4 x86_64",
          "product": {
            "name": "Red Hat Enterprise Linux Server",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat Enterprise Linux for IBM z Systems 8 s390x",
          "product": {
            "name": "Red Hat Enterprise Linux",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 10.2 ppc64le",
          "product": {
            "name": "Red Hat CodeReady Linux Builder",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 10.0 s390x",
          "product": {
            "name": "Red Hat CodeReady Linux Builder",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat Enterprise Linux for x86_64 - Extended Update Support 10.2 x86_64",
          "product": {
            "name": "Red Hat Enterprise Linux",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat Enterprise Linux for x86_64 8 x86_64",
          "product": {
            "name": "Red Hat Enterprise Linux",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.2 s390x",
          "product": {
            "name": "Red Hat Enterprise Linux",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat Enterprise Linux for x86_64 10 x86_64",
          "product": {
            "name": "Red Hat Enterprise Linux",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.6 ppc64le",
          "product": {
            "name": "Red Hat Enterprise Linux",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.4 ppc64le",
          "product": {
            "name": "Red Hat Enterprise Linux",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat Enterprise Linux Server - TUS 8.8 x86_64",
          "product": {
            "name": "Red Hat Enterprise Linux Server",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat Enterprise Linux for Real Time 8 x86_64",
          "product": {
            "name": "Red Hat Enterprise Linux",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.6 s390x",
          "product": {
            "name": "Red Hat Enterprise Linux",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat Enterprise Linux for x86_64 - Extended Update Support 10.0 x86_64",
          "product": {
            "name": "Red Hat Enterprise Linux",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.8 x86_64",
          "product": {
            "name": "Red Hat Enterprise Linux",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat Enterprise Linux for x86_64 - 4 years of updates 10.0 x86_64",
          "product": {
            "name": "Red Hat Enterprise Linux",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.4 ppc64le",
          "product": {
            "name": "Red Hat Enterprise Linux Server",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.2 x86_64",
          "product": {
            "name": "Red Hat Enterprise Linux",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 10.0 ppc64le",
          "product": {
            "name": "Red Hat CodeReady Linux Builder",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat Enterprise Linux Server - AUS 9.6 x86_64",
          "product": {
            "name": "Red Hat Enterprise Linux Server",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.6 s390x",
          "product": {
            "name": "Red Hat Enterprise Linux",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat CodeReady Linux Builder for x86_64 10 x86_64",
          "product": {
            "name": "Red Hat CodeReady Linux Builder",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.4 x86_64",
          "product": {
            "name": "Red Hat Enterprise Linux",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat Enterprise Linux for ARM 64 - Extended Update Support 10.2 aarch64",
          "product": {
            "name": "Red Hat Enterprise Linux",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat CodeReady Linux Builder for IBM z Systems 10 s390x",
          "product": {
            "name": "Red Hat CodeReady Linux Builder",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat Enterprise Linux for Power, little endian - 4 years of support 10.2 ppc64le",
          "product": {
            "name": "Red Hat Enterprise Linux",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat Enterprise Linux for Power, little endian - 4 years of support 10.0 ppc64le",
          "product": {
            "name": "Red Hat Enterprise Linux",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 10.2 x86_64",
          "product": {
            "name": "Red Hat Enterprise Linux",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.6 x86_64",
          "product": {
            "name": "Red Hat Enterprise Linux",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 8.10 x86_64",
          "product": {
            "name": "Red Hat Enterprise Linux",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.6 ppc64le",
          "product": {
            "name": "Red Hat Enterprise Linux Server",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.4 aarch64",
          "product": {
            "name": "Red Hat Enterprise Linux",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.6 aarch64",
          "product": {
            "name": "Red Hat Enterprise Linux",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.4 s390x",
          "product": {
            "name": "Red Hat Enterprise Linux",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.2 x86_64",
          "product": {
            "name": "Red Hat Enterprise Linux",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.6 aarch64",
          "product": {
            "name": "Red Hat Enterprise Linux",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 8.10 s390x",
          "product": {
            "name": "Red Hat Enterprise Linux",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.6 s390x",
          "product": {
            "name": "Red Hat Enterprise Linux",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.4 aarch64",
          "product": {
            "name": "Red Hat Enterprise Linux",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat Enterprise Linux for Real Time for x86_64 - Extended Life Cycle Support 7 x86_64",
          "product": {
            "name": "Red Hat Enterprise Linux",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat Enterprise Linux for ARM 64 8 aarch64",
          "product": {
            "name": "Red Hat Enterprise Linux",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat Enterprise Linux for ARM 64 10 aarch64",
          "product": {
            "name": "Red Hat Enterprise Linux",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat CodeReady Linux Builder for ARM 64 8 aarch64",
          "product": {
            "name": "Red Hat CodeReady Linux Builder",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 10.2 s390x",
          "product": {
            "name": "Red Hat CodeReady Linux Builder",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat Enterprise Linux for Power, little endian - Extended Update Support 10.0 ppc64le",
          "product": {
            "name": "Red Hat Enterprise Linux",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat Enterprise Linux for ARM 64 - 4 years of updates 10.2 aarch64",
          "product": {
            "name": "Red Hat Enterprise Linux",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 9.6 s390x",
          "product": {
            "name": "Red Hat CodeReady Linux Builder",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.4 x86_64",
          "product": {
            "name": "Red Hat Enterprise Linux",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat Enterprise Linux for Real Time for NFV 8 x86_64",
          "product": {
            "name": "Red Hat Enterprise Linux",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat Enterprise Linux Server - AUS 9.4 x86_64",
          "product": {
            "name": "Red Hat Enterprise Linux Server",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.6 aarch64",
          "product": {
            "name": "Red Hat Enterprise Linux",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 10.2 aarch64",
          "product": {
            "name": "Red Hat CodeReady Linux Builder",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 10.2 ppc64le",
          "product": {
            "name": "Red Hat Enterprise Linux",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.6 ppc64le",
          "product": {
            "name": "Red Hat Enterprise Linux",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat CodeReady Linux Builder for x86_64 8 x86_64",
          "product": {
            "name": "Red Hat CodeReady Linux Builder",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 10.0 aarch64",
          "product": {
            "name": "Red Hat CodeReady Linux Builder",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.6 x86_64",
          "product": {
            "name": "Red Hat Enterprise Linux",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.2 s390x",
          "product": {
            "name": "Red Hat Enterprise Linux",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 8.10 aarch64",
          "product": {
            "name": "Red Hat Enterprise Linux",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat Enterprise Linux for x86_64 - 4 years of updates 10.2 x86_64",
          "product": {
            "name": "Red Hat Enterprise Linux",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 10.0 s390x",
          "product": {
            "name": "Red Hat Enterprise Linux",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat Enterprise Linux Server - AUS 9.2 x86_64",
          "product": {
            "name": "Red Hat Enterprise Linux Server",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat CodeReady Linux Builder for ARM 64 10 aarch64",
          "product": {
            "name": "Red Hat CodeReady Linux Builder",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.4 s390x",
          "product": {
            "name": "Red Hat Enterprise Linux",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 10.2 s390x",
          "product": {
            "name": "Red Hat Enterprise Linux",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 10.0 x86_64",
          "product": {
            "name": "Red Hat CodeReady Linux Builder",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 9.6 aarch64",
          "product": {
            "name": "Red Hat CodeReady Linux Builder",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat Enterprise Linux for x86_64 - Extended Life Cycle Long Life 8.8 x86_64",
          "product": {
            "name": "Red Hat Enterprise Linux",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 9.6 x86_64",
          "product": {
            "name": "Red Hat CodeReady Linux Builder",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat Enterprise Linux for Power, little endian - Extended Update Support 10.2 ppc64le",
          "product": {
            "name": "Red Hat Enterprise Linux",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat Enterprise Linux for x86_64 - Extended Life Cycle Long Life 8.6 x86_64",
          "product": {
            "name": "Red Hat Enterprise Linux",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 10.2 s390x",
          "product": {
            "name": "Red Hat Enterprise Linux",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 8.10 ppc64le",
          "product": {
            "name": "Red Hat Enterprise Linux",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat CodeReady Linux Builder for Power, little endian 8 ppc64le",
          "product": {
            "name": "Red Hat CodeReady Linux Builder",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.8 ppc64le",
          "product": {
            "name": "Red Hat Enterprise Linux Server",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.2 aarch64",
          "product": {
            "name": "Red Hat Enterprise Linux",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 10.2 s390x",
          "product": {
            "name": "Red Hat Enterprise Linux",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.2 aarch64",
          "product": {
            "name": "Red Hat Enterprise Linux",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat Enterprise Linux for IBM z Systems 10 s390x",
          "product": {
            "name": "Red Hat Enterprise Linux",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat Enterprise Linux for Power, little endian 10 ppc64le",
          "product": {
            "name": "Red Hat Enterprise Linux",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat CodeReady Linux Builder for Power, little endian 10 ppc64le",
          "product": {
            "name": "Red Hat CodeReady Linux Builder",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat Enterprise Linux for x86_64 - Extended Life Cycle Long Life 8.4 x86_64",
          "product": {
            "name": "Red Hat Enterprise Linux",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 10.2 aarch64",
          "product": {
            "name": "Red Hat Enterprise Linux",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.2 ppc64le",
          "product": {
            "name": "Red Hat Enterprise Linux Server",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat Enterprise Linux for ARM 64 - 4 years of updates 10.0 aarch64",
          "product": {
            "name": "Red Hat Enterprise Linux",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        },
        {
          "description": "Red Hat Enterprise Linux for ARM 64 - Extended Update Support 10.0 aarch64",
          "product": {
            "name": "Red Hat Enterprise Linux",
            "vendor": {
              "name": "Red Hat",
              "scada": false
            }
          }
        }
      ],
      "affected_systems_content": "",
      "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
      "cves": [
        {
          "name": "CVE-2026-68480",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-68480"
        },
        {
          "name": "CVE-2026-64268",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-64268"
        },
        {
          "name": "CVE-2026-74581",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-74581"
        },
        {
          "name": "CVE-2026-72130",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-72130"
        },
        {
          "name": "CVE-2026-53399",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-53399"
        },
        {
          "name": "CVE-2026-53185",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-53185"
        },
        {
          "name": "CVE-2026-53391",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-53391"
        },
        {
          "name": "CVE-2026-68086",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-68086"
        },
        {
          "name": "CVE-2026-64189",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-64189"
        },
        {
          "name": "CVE-2026-64304",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-64304"
        },
        {
          "name": "CVE-2026-53397",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-53397"
        },
        {
          "name": "CVE-2026-64276",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-64276"
        },
        {
          "name": "CVE-2026-64438",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-64438"
        },
        {
          "name": "CVE-2026-68166",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-68166"
        },
        {
          "name": "CVE-2026-43023",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-43023"
        },
        {
          "name": "CVE-2026-53006",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-53006"
        },
        {
          "name": "CVE-2026-43450",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-43450"
        },
        {
          "name": "CVE-2026-63800",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-63800"
        },
        {
          "name": "CVE-2026-46099",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-46099"
        },
        {
          "name": "CVE-2026-74580",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-74580"
        },
        {
          "name": "CVE-2026-64418",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-64418"
        },
        {
          "name": "CVE-2026-43454",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-43454"
        },
        {
          "name": "CVE-2026-46120",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-46120"
        },
        {
          "name": "CVE-2024-57849",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-57849"
        },
        {
          "name": "CVE-2026-64320",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-64320"
        },
        {
          "name": "CVE-2026-53361",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-53361"
        },
        {
          "name": "CVE-2026-53053",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-53053"
        },
        {
          "name": "CVE-2026-53392",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-53392"
        },
        {
          "name": "CVE-2026-64018",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-64018"
        },
        {
          "name": "CVE-2025-71132",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-71132"
        },
        {
          "name": "CVE-2026-46150",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-46150"
        },
        {
          "name": "CVE-2026-53189",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-53189"
        },
        {
          "name": "CVE-2026-53059",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-53059"
        },
        {
          "name": "CVE-2026-45984",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-45984"
        },
        {
          "name": "CVE-2026-46145",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-46145"
        },
        {
          "name": "CVE-2024-46744",
          "url": "https://www.cve.org/CVERecord?id=CVE-2024-46744"
        },
        {
          "name": "CVE-2026-74582",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-74582"
        },
        {
          "name": "CVE-2026-45970",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-45970"
        },
        {
          "name": "CVE-2026-64136",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-64136"
        },
        {
          "name": "CVE-2026-64277",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-64277"
        },
        {
          "name": "CVE-2026-46056",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-46056"
        },
        {
          "name": "CVE-2026-53153",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-53153"
        },
        {
          "name": "CVE-2026-53026",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-53026"
        },
        {
          "name": "CVE-2026-23003",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-23003"
        },
        {
          "name": "CVE-2026-64490",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-64490"
        },
        {
          "name": "CVE-2026-43114",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-43114"
        },
        {
          "name": "CVE-2026-64384",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-64384"
        },
        {
          "name": "CVE-2025-21834",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-21834"
        },
        {
          "name": "CVE-2026-74480",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-74480"
        },
        {
          "name": "CVE-2026-52923",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-52923"
        },
        {
          "name": "CVE-2026-72069",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-72069"
        },
        {
          "name": "CVE-2026-43116",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-43116"
        },
        {
          "name": "CVE-2026-53196",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-53196"
        },
        {
          "name": "CVE-2026-64298",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-64298"
        },
        {
          "name": "CVE-2025-68211",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-68211"
        },
        {
          "name": "CVE-2026-64002",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-64002"
        },
        {
          "name": "CVE-2023-52924",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-52924"
        }
      ],
      "initial_release_date": "2026-09-04T00:00:00",
      "last_revision_date": "2026-09-04T00:00:00",
      "links": [],
      "reference": "CERTFR-2026-AVI-1118",
      "revisions": [
        {
          "description": "Version initiale",
          "revision_date": "2026-09-04T00:00:00.000000"
        }
      ],
      "risks": [
        {
          "description": "D\u00e9ni de service \u00e0 distance"
        },
        {
          "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
        },
        {
          "description": "Ex\u00e9cution de code arbitraire"
        },
        {
          "description": "Contournement de la politique de s\u00e9curit\u00e9"
        },
        {
          "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
        },
        {
          "description": "\u00c9l\u00e9vation de privil\u00e8ges"
        }
      ],
      "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans le noyau Linux de Red Hat. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire, une \u00e9l\u00e9vation de privil\u00e8ges et un d\u00e9ni de service \u00e0 distance.",
      "title": "Multiples vuln\u00e9rabilit\u00e9s dans le noyau Linux de Red Hat",
      "vendor_advisories": [
        {
          "published_at": "2026-09-02",
          "title": "Bulletin de s\u00e9curit\u00e9 Red Hat RHSA-2026:62609",
          "url": "https://access.redhat.com/errata/RHSA-2026:62609"
        },
        {
          "published_at": "2026-09-01",
          "title": "Bulletin de s\u00e9curit\u00e9 Red Hat RHSA-2026:61973",
          "url": "https://access.redhat.com/errata/RHSA-2026:61973"
        },
        {
          "published_at": "2026-09-04",
          "title": "Bulletin de s\u00e9curit\u00e9 Red Hat RHSA-2026:63539",
          "url": "https://access.redhat.com/errata/RHSA-2026:63539"
        },
        {
          "published_at": "2026-09-01",
          "title": "Bulletin de s\u00e9curit\u00e9 Red Hat RHSA-2026:61959",
          "url": "https://access.redhat.com/errata/RHSA-2026:61959"
        },
        {
          "published_at": "2026-09-02",
          "title": "Bulletin de s\u00e9curit\u00e9 Red Hat RHSA-2026:62372",
          "url": "https://access.redhat.com/errata/RHSA-2026:62372"
        },
        {
          "published_at": "2026-08-31",
          "title": "Bulletin de s\u00e9curit\u00e9 Red Hat RHSA-2026:61310",
          "url": "https://access.redhat.com/errata/RHSA-2026:61310"
        },
        {
          "published_at": "2026-09-04",
          "title": "Bulletin de s\u00e9curit\u00e9 Red Hat RHSA-2026:63537",
          "url": "https://access.redhat.com/errata/RHSA-2026:63537"
        },
        {
          "published_at": "2026-09-02",
          "title": "Bulletin de s\u00e9curit\u00e9 Red Hat RHSA-2026:62522",
          "url": "https://access.redhat.com/errata/RHSA-2026:62522"
        },
        {
          "published_at": "2026-09-03",
          "title": "Bulletin de s\u00e9curit\u00e9 Red Hat RHSA-2026:63189",
          "url": "https://access.redhat.com/errata/RHSA-2026:63189"
        },
        {
          "published_at": "2026-09-02",
          "title": "Bulletin de s\u00e9curit\u00e9 Red Hat RHSA-2026:62508",
          "url": "https://access.redhat.com/errata/RHSA-2026:62508"
        },
        {
          "published_at": "2026-09-02",
          "title": "Bulletin de s\u00e9curit\u00e9 Red Hat RHSA-2026:62345",
          "url": "https://access.redhat.com/errata/RHSA-2026:62345"
        },
        {
          "published_at": "2026-09-02",
          "title": "Bulletin de s\u00e9curit\u00e9 Red Hat RHSA-2026:62568",
          "url": "https://access.redhat.com/errata/RHSA-2026:62568"
        },
        {
          "published_at": "2026-09-03",
          "title": "Bulletin de s\u00e9curit\u00e9 Red Hat RHSA-2026:63013",
          "url": "https://access.redhat.com/errata/RHSA-2026:63013"
        },
        {
          "published_at": "2026-09-02",
          "title": "Bulletin de s\u00e9curit\u00e9 Red Hat RHSA-2026:62346",
          "url": "https://access.redhat.com/errata/RHSA-2026:62346"
        },
        {
          "published_at": "2026-09-01",
          "title": "Bulletin de s\u00e9curit\u00e9 Red Hat RHSA-2026:61887",
          "url": "https://access.redhat.com/errata/RHSA-2026:61887"
        },
        {
          "published_at": "2026-09-03",
          "title": "Bulletin de s\u00e9curit\u00e9 Red Hat RHSA-2026:63014",
          "url": "https://access.redhat.com/errata/RHSA-2026:63014"
        }
      ]
    }